CVE-2026-2913
Heap-Based Buffer Overflow in libvips vips_source_read_to_memory Function
Publication date: 2026-02-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libvips | libvips | to 8.19.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2913 is a heap-based buffer overflow vulnerability in the libvips image processing library, specifically in the function vips_source_read_to_memory within source.c.
The root cause is an integer truncation issue: libvips uses a 64-bit length value for data sources, but the buffer allocation function accepts only a 32-bit unsigned integer. When the source length exceeds the 32-bit maximum (greater than 4 GiB), the allocation size is truncated, resulting in a smaller buffer than needed.
Despite the truncated allocation, the code attempts to read and write data up to the full 64-bit length, causing writes beyond the allocated buffer boundary and leading to a heap-buffer-overflow.
This vulnerability can be triggered locally by providing a custom seekable source larger than 4 GiB, and a proof-of-concept exploit demonstrates the overflow causing a crash.
How can this vulnerability impact me? :
The vulnerability can cause a heap-based buffer overflow, which may lead to memory corruption and application crashes.
However, the impact is considered negligible because it only affects custom seekable sources larger than 4 GiB, and the crash occurs in user code rather than within libvips itself.
Exploitation requires local access and is rated as difficult due to the complexity of triggering the condition.
The vulnerability primarily impacts availability by causing crashes, but does not affect confidentiality or integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a heap-based buffer overflow occurring in the libvips library when processing custom seekable sources larger than 4 GiB. Detection involves identifying if libvips version 8.19.0 or earlier is in use and if it processes large custom sources that could trigger the overflow.
Since the vulnerability triggers a heap-buffer-overflow during memory allocation and reading, one practical detection method is to run libvips with AddressSanitizer (ASAN) or UndefinedBehaviorSanitizer (UBSAN) enabled. These tools can detect memory corruption such as buffer overflows.
A proof-of-concept involves creating a custom VipsSourceCustom object with a length exceeding 4 GiB (e.g., (1 << 32) + 1024 bytes) and running libvips with sanitizers to observe crashes or errors indicating heap-buffer-overflow.
No specific network commands are provided since the attack is local and triggered by local processing of large custom sources.
- Compile libvips with ASAN/UBSAN enabled.
- Run a test program or script that uses libvips to process a custom seekable source larger than 4 GiB.
- Observe for heap-buffer-overflow errors or crashes during the read operation.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to apply the official patch identified by commit a56feecbe9ed66521d9647ec9fbcd2546eccd7ee which adds explicit length overflow checks to prevent buffer overflow.
This patch ensures that if the source length exceeds the maximum 32-bit unsigned integer value, the operation is aborted with an error instead of causing a heap-buffer-overflow.
If patching is not immediately possible, avoid processing custom seekable sources larger than 4 GiB with libvips version 8.19.0 or earlier.
Monitor for updates from libvips and upgrade to a fixed version as soon as it becomes available.