CVE-2026-70652

Received Received - Intake

Heap Buffer Over-Read in libvips Image Processing Library

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-70652

Affected Vendors & Products

Vendor	Product	Version / Range
libvips	libvips	to 8.18.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

libvips is a fast image processing library. Prior to version 8.18.3, a bug in libvips with libultrahdr support can incorrectly allocate an output buffer when enlarging a JPEG image to a very large size before encoding a gain map. This leads to an undersized buffer that may cause a heap buffer over-read, potentially exposing adjacent data or crashing the process.

Detection Guidance

This vulnerability can be detected by checking the version of libvips installed on your system. If you are running a version prior to 8.18.3, your system is vulnerable. Use the command 'vips --version' to check the installed version.

Impact Analysis

This vulnerability may allow an attacker to read sensitive memory or crash the application processing images. It primarily affects systems using libvips with libultrahdr for image processing tasks involving large JPEG enlargements.

Mitigation Strategies

Immediately update libvips to version 8.18.3 or later. This can typically be done using your package manager, such as 'apt-get upgrade libvips' for Debian-based systems or 'yum update libvips' for RHEL-based systems.

Hi! I’m here to help you understand CVE-2026-70652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70