Executive brief
libvips is an image processing library used in web services, content management systems, and graphics applications to resize, transform, and convert images. When processing enlarged JPEG images with Ultra HDR support enabled, versions prior to 8.18.3 allocate an undersized buffer that can be read beyond its bounds, potentially exposing sensitive adjacent memory or crashing the application.
Technical details
A heap buffer over-read vulnerability exists in libvips/foreign/uhdrsave.c within the vips_foreign_save_uhdr_set_raw_hdr function when libultrahdr support is compiled in. The vulnerability occurs when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr, resulting in incorrect buffer sizing. An attacker can trigger this by providing a specially crafted large JPEG image, causing out-of-bounds memory read that may disclose adjacent heap data or crash the process. No user authentication or privileges are required; the issue is fixed in version 8.18.3 by using the correct VIPS_IMAGE_N_PELS() macro for buffer allocation.
Affected products
- libvips libvips prior to 8.18.3
Timeline
- 2026-08-20: disclosed
- 2026-05-13: patched: Fix merged in version 8.18.3