Executive brief
libvips is a widely-used image processing library. When applications using libvips process untrusted PPM image files with custom source handlers, a buffer overflow can occur, potentially causing a crash or memory corruption that could lead to code execution.
Technical details
A copy-paste error in the vips_source_read_to_memory function in libvips/iofuncs/source.c uses VIPS_MAX instead of VIPS_MIN when calculating the remaining read size for heap-allocated buffers. When processing uncompressed PPM images with custom source definitions, this allows up to 4032 bytes to be written beyond the allocated buffer boundary. The vulnerability requires both custom source definitions and untrusted PPM input. The issue is fixed in libvips 8.18.3 (patched May 13, 2026).
Affected products
- libvips libvips prior to 8.18.3
Timeline
- 2026-08-20: disclosed
- 2026-05-13: patched: Fixed in version 8.18.3