CVE-2026-70652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8
https://github.com/libvips/libvips/pull/5039
https://github.com/libvips/libvips/releases/tag/v8.18.3
https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) libvips es una biblioteca de procesamiento de imágenes rápida con bajas necesidades de memoria. Antes de la versión 8.18.3, libvips compilado con soporte para libultrahdr puede dimensionar incorrectamente un búfer de salida en libvips/foreign/uhdrsave.c dentro de vips_foreign_save_uhdr_set_raw_hdr cuando una tubería agranda un JPEG entrante a una salida muy grande antes de codificar un mapa de ganancia a través de VipsForeignSaveUhdr. La asignación de tamaño insuficiente puede causar una lectura excesiva del búfer de pila que puede revelar datos adyacentes o bloquear el proceso. Este problema está solucionado en la versión 8.18.3.

Information

Published : 2026-08-20 21:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-70652

Mitre link : CVE-2026-70652

CVE.ORG link : CVE-2026-70652

JSON object : View

Products Affected

No product.

CWE

CWE-126

Buffer Over-read

{"id": "CVE-2026-70652", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70652", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T20:58:36.766334Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}]}], "published": "2026-08-20T21:17:08.270", "references": [{"url": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/pull/5039", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-126"}]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3."}, {"lang": "es", "value": "libvips es una biblioteca de procesamiento de im\u00e1genes r\u00e1pida con bajas necesidades de memoria. Antes de la versi\u00f3n 8.18.3, libvips compilado con soporte para libultrahdr puede dimensionar incorrectamente un b\u00fafer de salida en libvips/foreign/uhdrsave.c dentro de vips_foreign_save_uhdr_set_raw_hdr cuando una tuber\u00eda agranda un JPEG entrante a una salida muy grande antes de codificar un mapa de ganancia a trav\u00e9s de VipsForeignSaveUhdr. La asignaci\u00f3n de tama\u00f1o insuficiente puede causar una lectura excesiva del b\u00fafer de pila que puede revelar datos adyacentes o bloquear el proceso. Este problema est\u00e1 solucionado en la versi\u00f3n 8.18.3."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "security-advisories@github.com"}