EUVD-2026-46000Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Matches vendor local vector: attacker feeds a crafted image to vipsload with low privileges and no interaction; heap overflow yields high integrity/availability impact but no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.
AnalysisAI
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipsload operation corrupt heap memory. The library incorrectly computes image dimensions, allowing an integer overflow (CWE-190) in the element/pel/line/image size calculation that produces an undersized allocation followed by an out-of-bounds write. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 8.18.1. CVSS 4.0 base score is 7.0 with high integrity and availability impact.
Technical ContextAI
libvips is a widely embedded C image-processing library (notably the engine behind the Node.js 'sharp' module) that emphasizes low memory use via demand-driven pipelines. The flaw sits in the image sanity/build path in libvips/iofuncs/image.c: the VIPS_IMAGE_SIZEOF_ELEMENT/PEL/LINE/IMAGE macros multiply element size by bands, Xsize (width) and Ysize (height) as 64-bit values with no overflow guard. When the vipsload native-format loader accepts attacker-controlled dimension metadata, the product es * bands * width * height can wrap around, so a buffer sized from the wrapped value is later written past its bounds - the classic CWE-190 integer-overflow-to-heap-overflow pattern. The patch (PR #4934, commit 61e71c13) adds g_uint64_checked_mul() checks and a G_MAXSIZE-16 bound for SETBUF images, emitting a 'dimension overflow' sanity error instead of allocating.
RemediationAI
Vendor-released patch: 8.18.1 - upgrade libvips to 8.18.1 or later, which adds explicit g_uint64_checked_mul() dimension-overflow guards in the image build/sanity path (PR https://github.com/libvips/libvips/pull/4934, commit https://github.com/libvips/libvips/commit/61e71c13328ed72d0a530dffc19b9b225072bdf9). Rebuild or update any downstream package that statically links or bundles libvips (for example, ensure 'sharp' is on a release built against 8.18.1+). Where immediate patching is not possible, restrict the vipsload operation to trusted inputs only and validate/normalize image dimensions before processing untrusted uploads; note the trade-off that pre-validation cannot fully replicate the library's internal checks and may reject legitimate large images. Consult GHSA-2fcj-gj27-279x for the authoritative fix details.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in
Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today