CVE-2026-70654

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/libvips/libvips/commit/80e021c6cdda0f80b756c2109d99839c94c03258
https://github.com/libvips/libvips/pull/5038
https://github.com/libvips/libvips/releases/tag/v8.18.3
https://github.com/libvips/libvips/security/advisories/GHSA-rjmm-3qch-m9rg

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) libvips es una rápida biblioteca de procesamiento de imágenes con bajas necesidades de memoria. Antes de la versión 8.18.3, las aplicaciones que definen fuentes libvips personalizadas inusuales y las usan para procesar imágenes PPM sin comprimir no confiables pueden desencadenar un error de max/min en vips_source_read_to_memory en libvips/iofuncs/source.c. La función utiliza VIPS_MAX en lugar de VIPS_MIN al seleccionar el tamaño de lectura restante, permitiendo que se escriban hasta 4032 bytes más allá del búfer de pila asignado y causando corrupción de memoria o un fallo del proceso. Este problema está solucionado en la versión 8.18.3.

Information

Published : 2026-08-20 21:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-70654

Mitre link : CVE-2026-70654

CVE.ORG link : CVE-2026-70654

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-70654", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70654", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T11:32:57.942167Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}]}], "published": "2026-08-20T21:17:08.567", "references": [{"url": "https://github.com/libvips/libvips/commit/80e021c6cdda0f80b756c2109d99839c94c03258", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/pull/5038", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/security/advisories/GHSA-rjmm-3qch-m9rg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3."}, {"lang": "es", "value": "libvips es una r\u00e1pida biblioteca de procesamiento de im\u00e1genes con bajas necesidades de memoria. Antes de la versi\u00f3n 8.18.3, las aplicaciones que definen fuentes libvips personalizadas inusuales y las usan para procesar im\u00e1genes PPM sin comprimir no confiables pueden desencadenar un error de max/min en vips_source_read_to_memory en libvips/iofuncs/source.c. La funci\u00f3n utiliza VIPS_MAX en lugar de VIPS_MIN al seleccionar el tama\u00f1o de lectura restante, permitiendo que se escriban hasta 4032 bytes m\u00e1s all\u00e1 del b\u00fafer de pila asignado y causando corrupci\u00f3n de memoria o un fallo del proceso. Este problema est\u00e1 solucionado en la versi\u00f3n 8.18.3."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "security-advisories@github.com"}