Monthly
Denial of service in libvips 8.19.0 occurs when a service decodes an attacker-supplied little-endian PFM (Portable FloatMap) image whose text header length is not a multiple of four bytes, leaving the mmap-backed pixel buffer misaligned for float access; vips_avg_scan() then dereferences that buffer as a float pointer, producing undefined behavior that terminates the process on strict-alignment targets or UBSan-instrumented builds. The issue is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), but real-world impact is narrow: the victim must actually route untrusted PFM input into libvips 8.19.0, and the misaligned float access is harmless on x86/x86_64 and other alignment-tolerant builds, so the assessed attack complexity is high and the practical consequence is availability-only. No public exploit code was identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and there is no CISA KEV listing; the underlying issue is tracked upstream as libvips GitHub issue 5187.
Denial of service in libvips 8.19.0 occurs when a service decodes an attacker-supplied little-endian PFM (Portable FloatMap) image whose text header length is not a multiple of four bytes, leaving the mmap-backed pixel buffer misaligned for float access; vips_avg_scan() then dereferences that buffer as a float pointer, producing undefined behavior that terminates the process on strict-alignment targets or UBSan-instrumented builds. The issue is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), but real-world impact is narrow: the victim must actually route untrusted PFM input into libvips 8.19.0, and the misaligned float access is harmless on x86/x86_64 and other alignment-tolerant builds, so the assessed attack complexity is high and the practical consequence is availability-only. No public exploit code was identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and there is no CISA KEV listing; the underlying issue is tracked upstream as libvips GitHub issue 5187.