CVE-2026-70652: libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libvipsto a version that resolves this vulnerability.Fixed in 8.18.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using libvips built with libultrahdr support are affected when they process a pipeline that enlarges an incoming JPEG to a very large output and then encodes a gain map through VipsForeignSaveUhdr.
What input and processing conditions are needed to trigger the issue?
The triggering condition is an incoming JPEG that is resized to a very large output before gain-map encoding through VipsForeignSaveUhdr. Under those conditions, the output buffer can be allocated too small.
How can I determine whether an environment still needs remediation?
Check whether the installed libvips version is earlier than 8.18.3 and whether it was built with libultrahdr support. Also identify workloads that use VipsForeignSaveUhdr to create gain maps after substantially enlarging JPEG inputs.
What is the available fix?
Upgrade libvips to version 8.18.3, which fixes the incorrect output-buffer sizing.