CVE-2026-70654

Received Received - Intake

Heap Buffer Overflow in libvips Image Processing

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-70654

Affected Vendors & Products

Vendor	Product	Version / Range
libvips	libvips	to 8.18.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability affects libvips, an image processing library, before version 8.18.3. It occurs when custom sources process untrusted uncompressed PPM images, causing a buffer overflow due to incorrect size calculation in vips_source_read_to_memory. The function uses VIPS_MAX instead of VIPS_MIN, allowing up to 4032 bytes to be written beyond the allocated heap buffer.

Detection Guidance

This vulnerability can be detected by checking the version of libvips installed on your system. If it is below 8.18.3, the system is vulnerable. Use commands like 'vips --version' or 'dpkg -l libvips' (for Debian-based systems) to check the version.

Impact Analysis

The vulnerability can lead to memory corruption or a process crash. If exploited, it may allow attackers to execute arbitrary code or cause denial-of-service conditions on systems using vulnerable versions of libvips.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a memory corruption issue in a specific image processing library. However, if exploited, it could lead to arbitrary code execution or denial of service, potentially compromising systems handling sensitive data. This may indirectly impact compliance by increasing the risk of data breaches or unauthorized access.

Mitigation Strategies

Immediately update libvips to version 8.18.3 or later. For Debian-based systems, use 'sudo apt-get update && sudo apt-get install --only-upgrade libvips'. For other systems, follow the official libvips installation instructions to upgrade.

Hi! I’m here to help you understand CVE-2026-70654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70