Executive Summary

CVE-2026-2913 is a heap-based buffer overflow vulnerability in the libvips image processing library, specifically in the function vips_source_read_to_memory within source.c.

The root cause is an integer truncation issue: libvips uses a 64-bit length value for data sources, but the buffer allocation function accepts only a 32-bit unsigned integer. When the source length exceeds the 32-bit maximum (greater than 4 GiB), the allocation size is truncated, resulting in a smaller buffer than needed.

Despite the truncated allocation, the code attempts to read and write data up to the full 64-bit length, causing writes beyond the allocated buffer boundary and leading to a heap-buffer-overflow.

This vulnerability can be triggered locally by providing a custom seekable source larger than 4 GiB, and a proof-of-concept exploit demonstrates the overflow causing a crash.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a heap-based buffer overflow, which may lead to memory corruption and application crashes.

However, the impact is considered negligible because it only affects custom seekable sources larger than 4 GiB, and the crash occurs in user code rather than within libvips itself.

Exploitation requires local access and is rated as difficult due to the complexity of triggering the condition.

The vulnerability primarily impacts availability by causing crashes, but does not affect confidentiality or integrity.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a heap-based buffer overflow occurring in the libvips library when processing custom seekable sources larger than 4 GiB. Detection involves identifying if libvips version 8.19.0 or earlier is in use and if it processes large custom sources that could trigger the overflow.

Since the vulnerability triggers a heap-buffer-overflow during memory allocation and reading, one practical detection method is to run libvips with AddressSanitizer (ASAN) or UndefinedBehaviorSanitizer (UBSAN) enabled. These tools can detect memory corruption such as buffer overflows.

A proof-of-concept involves creating a custom VipsSourceCustom object with a length exceeding 4 GiB (e.g., (1 << 32) + 1024 bytes) and running libvips with sanitizers to observe crashes or errors indicating heap-buffer-overflow.

No specific network commands are provided since the attack is local and triggered by local processing of large custom sources.

• Compile libvips with ASAN/UBSAN enabled.
• Run a test program or script that uses libvips to process a custom seekable source larger than 4 GiB.
• Observe for heap-buffer-overflow errors or crashes during the read operation.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to apply the official patch identified by commit a56feecbe9ed66521d9647ec9fbcd2546eccd7ee which adds explicit length overflow checks to prevent buffer overflow.

This patch ensures that if the source length exceeds the maximum 32-bit unsigned integer value, the operation is aborted with an error instead of causing a heap-buffer-overflow.

If patching is not immediately possible, avoid processing custom seekable sources larger than 4 GiB with libvips version 8.19.0 or earlier.

Monitor for updates from libvips and upgrade to a fixed version as soon as it becomes available.

Useful 0 Not Useful 0