EUVD-2026-63656Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and custom source prerequisite drive AV:L and AC:H; PR:L reflects low-privilege requirement; primary impact is process crash (A:H) with minor heap integrity effect (I:L) and no confidentiality exposure.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.
AnalysisAI
Heap buffer overflow in libvips prior to 8.18.3 allows up to 4032 bytes to be written beyond an allocated heap buffer during processing of untrusted uncompressed PPM images via custom source objects, potentially causing memory corruption or a process crash. The flaw exists specifically in vips_source_read_to_memory in libvips/iofuncs/source.c, where VIPS_MAX was used instead of VIPS_MIN when computing the remaining read size. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: the target application must define and use a custom VipsSource object (not the standard libvips file or memory source), it must process untrusted or attacker-controlled uncompressed PPM image data through that source, and the attacker must have at least low-privileged local access or the ability to supply input to the image processing pipeline (PR:L, AV:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is constrained by the CVSS 4.0 vector AV:L/AC:H/AT:P/PR:L, which indicates local access, high attack complexity, specific prerequisite attack requirements (AT:P), and low-privilege access - all of which must align simultaneously. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libvips to version 8.18.3 or later, as confirmed by the upstream GitHub release tag https://github.com/libvips/libvips/releases/tag/v8.18.3 and the fix commit https://github.com/libvips/libvips/commit/80e021c6cdda0f80b756c2109d99839c94c03258. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today