EUVD-2026-23432Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".
AnalysisAI
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecated/vips7compat.c allows authenticated local attackers to trigger memory corruption through manipulation of the argument n, with publicly available exploit code confirmed and vendor commitment to remove the deprecated code in libvips 8.19.
Technical ContextAI
libvips is an image processing library commonly integrated into applications requiring fast, memory-efficient image manipulation. The vulnerable function im_minpos_vec resides in the deprecated vips7compat.c module, which provides backward compatibility with the legacy vips7 API. The vulnerability is a heap-based buffer overflow (CWE-122) triggered by improper bounds checking on the argument n, which controls iteration or memory access within the function. When an attacker supplies a maliciously crafted value for n, the function writes beyond the allocated heap buffer, corrupting adjacent memory structures. This resides in code marked for deprecation, indicating the vendor has already acknowledged the maintenance burden and security risk of maintaining legacy API compatibility.
RemediationAI
Upgrade libvips to version 8.19 or later, which will remove the deprecated vips7compat.c module entirely and eliminate the vulnerable function. For systems unable to immediately upgrade, apply two complementary mitigations: (1) Audit application code to identify and eliminate all calls to im_minpos_vec and other functions from libvips/deprecated/vips7compat.c, replacing them with equivalent vips8 API calls; this requires code review and testing but completely eliminates the attack surface for affected functions. (2) Implement access controls restricting local login and interactive access to systems running applications that embed libvips, since the vulnerability requires local authenticated access (PR:L); this reduces but does not eliminate risk if the application itself processes untrusted input passed from remote sources. No workarounds exist for the function itself short of disabling it entirely. Reference the vendor advisory and GitHub issue https://github.com/libvips/libvips/issues/4965 for migration guidance and patch release notes.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today