# CVE-2026-70652: libvips heap buffer over-read in UHDR save

Source: https://junglewise.ai/threats/cve-2026-70652-libvips-heap-buffer-over-read-in-uhdr-save  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70652 · Severity: info · Published 2026-08-20

libvips is an image processing library used in web services, content management systems, and graphics applications to resize, transform, and convert images. When processing enlarged JPEG images with Ultra HDR support enabled, versions prior to 8.18.3 allocate an undersized buffer that can be read beyond its bounds, potentially exposing sensitive adjacent memory or crashing the application.

Technologies: [Libvips](https://junglewise.ai/threats/technologies/libvips). Vendors: [Libvips](https://junglewise.ai/threats/vendors/libvips).

## Quick answers

**Is CVE-2026-70652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70652 being exploited in the wild.

**How severe is CVE-2026-70652?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** Libvips prior to 8.18.3.

**Is there a fix for CVE-2026-70652?** A patch was published on 2026-05-13: Fix merged in version 8.18.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70652 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-70652?** Check whether you run Libvips at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer over-read vulnerability exists in libvips/foreign/uhdrsave.c within the vips_foreign_save_uhdr_set_raw_hdr function when libultrahdr support is compiled in. The vulnerability occurs when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr, resulting in incorrect buffer sizing. An attacker can trigger this by providing a specially crafted large JPEG image, causing out-of-bounds memory read that may disclose adjacent heap data or crash the process. No user authentication or privileges are required; the issue is fixed in version 8.18.3 by using the correct VIPS_IMAGE_N_PELS() macro for buffer allocation.

## Affected products

- libvips libvips prior to 8.18.3

## Timeline

- 2026-08-20: disclosed
- 2026-05-13: patched: Fix merged in version 8.18.3

## References

- [https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8](https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8)
- [https://github.com/libvips/libvips/pull/5039](https://github.com/libvips/libvips/pull/5039)

## Related threats

- [libvips misaligned float load in PFM image processing](https://junglewise.ai/threats/cve-2026-88360-libvips-8-19-0-contains-a-memory-access-vulnerability-when)
- [libvips heap buffer overflow in PPM source processing](https://junglewise.ai/threats/cve-2026-70654-libvips-heap-buffer-overflow-in-ppm-source-processing)
- [libvips Radiance RLE decoder heap disclosure](https://junglewise.ai/threats/cve-2026-70653-libvips-radiance-rle-decoder-heap-disclosure)
- [libvips heap buffer over-read in ImageMagick fallback path](https://junglewise.ai/threats/cve-2026-70651-libvips-heap-buffer-over-read-in-imagemagick-fallback-path)
- [libvips integer overflow in TIFF scanline processing](https://junglewise.ai/threats/cve-2026-69242-libvips-integer-overflow-in-tiff-scanline-processing)