CVE-2026-2913: libvips source.c vips_source_read_to_memory heap-based overflow
A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vipssourcereadtomemory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2913?
CVE-2026-2913 is categorized as a high-severity vulnerability due to its potential for heap-based buffer overflow.
How do I fix CVE-2026-2913?
To fix CVE-2026-2913, update libvips to version 8.19.1 or later which addresses the buffer overflow issue.
What versions of libvips are affected by CVE-2026-2913?
CVE-2026-2913 affects libvips versions up to and including 8.19.0.
What is the impact of exploiting CVE-2026-2913?
Exploiting CVE-2026-2913 can lead to arbitrary code execution due to a heap-based buffer overflow.
How can I mitigate the risk associated with CVE-2026-2913?
Mitigation for CVE-2026-2913 involves ensuring that all instances of libvips are updated to a secure version and monitoring for any near-term exploits.