EUVD-2026-23432Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local system access as authenticated user
-
DeliveryInvoke application or library using libvips
-
ExploitCraft malicious n argument to im_minpos_vec
-
ExecutionTrigger heap buffer overflow
-
PersistCorrupt adjacent memory structures
-
ImpactPotential code execution or information disclosure
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following: (1) Application or library must explicitly invoke the im_minpos_vec function from libvips/deprecated/vips7compat.c (not required for applications using only vips8 API); (2) Attacker must be an authenticated local user with execution privileges on the system (PR:L in CVSS vector); (3) The vulnerable libvips version must be 8.18.2 or earlier; (4) The n argument passed to im_minpos_vec must be user-controllable or derived from untrusted input. The vulnerability does NOT affect systems where: libvips has been upgraded to 8.19+, applications use only the modern vips8 API, untrusted users cannot execute code or submit input to processes calling the deprecated function, or the deprecated vips7compat.c functions are not linked into the application binary (some build configurations may exclude deprecated modules). |
| Impact | CVSS 4.8 with AV:L/AC:L/PR:L indicates a locally exploitable vulnerability requiring authenticated access, with low attack complexity but limited scope of impact (VC:L, VI:L, VA:L). The E:P flag signals publicly available exploit code, elevating real-world risk beyond the base score. However, several mitigating factors reduce practical impact: (1) authentication requirement (PR:L) limits attack surface to local authenticated users, (2) deprecated function status means new code should not invoke im_minpos_vec and applications using vips8+ API are unaffected, (3) limited scope (S:X/SC:N/SI:N/SA:N) suggests impact is isolated to the vulnerable process rather than system-wide. CISA KEV status unknown from input data. The public POC availability combined with local-only attack vector creates moderate risk for systems where untrusted local users can interact with applications embedding libvips, particularly legacy applications still calling vips7 compatibility functions. Organizations using libvips primarily through the modern vips8 API should assess whether they have any code paths that invoke the deprecated im_minpos_vec function. |
| Exploit ScenarioDerived | A local authenticated user with shell access to a system running an older application that uses libvips (version 8.18.2 or earlier) crafts a request to the application that triggers image processing via the deprecated im_minpos_vec function with a maliciously large value for the n argument. The crafted input causes the function to write beyond heap buffer boundaries, corrupting adjacent memory structures and potentially allowing the attacker to achieve information disclosure or, in carefully constructed scenarios, code execution within the application's process context. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 17, 2026
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecated/vips7compat.c allows authenticated local attackers to trigger memory corruption through manipulation of the argument n, with publicly available exploit code confirmed and vendor commitment to remove the deprecated code in libvips 8.19.
RemediationAI
Upgrade libvips to version 8.19 or later, which will remove the deprecated vips7compat.c module entirely and eliminate the vulnerable function. For systems unable to immediately upgrade, apply two complementary mitigations: (1) Audit application code to identify and eliminate all calls to im_minpos_vec and other functions from libvips/deprecated/vips7compat.c, replacing them with equivalent vips8 API calls; this requires code review and testing but completely eliminates the attack surface for affected functions. (2) Implement access controls restricting local login and interactive access to systems running applications that embed libvips, since the vulnerability requires local authenticated access (PR:L); this reduces but does not eliminate risk if the application itself processes untrusted input passed from remote sources. No workarounds exist for the function itself short of disabling it entirely. Reference the vendor advisory and GitHub issue https://github.com/libvips/libvips/issues/4965 for migration guidance and patch release notes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libvips is an image processing library commonly integrated into applications requiring fast, memory-efficient image manipulation. The vulnerable function im_minpos_vec resides in the deprecated vips7compat.c module, which provides backward compatibility with the legacy vips7 API. The vulnerability is a heap-based buffer overflow (CWE-122) triggered by improper bounds checking on the argument n, which controls iteration or memory access within the function. When an attacker supplies a maliciously crafted value for n, the function writes beyond the allocated heap buffer, corrupting adjacent memory structures. This resides in code marked for deprecation, indicating the vendor has already acknowledged the maintenance burden and security risk of maintaining legacy API compatibility.
Know when Libvips gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in
Exploit-DB