CVE-2026-70654: libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The function uses VIPSMAX instead of VIPSMIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libvipsto a version that resolves this vulnerability.Fixed in 8.18.3
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libvips versions before 8.18.3 are exposed when they define unusual custom libvips sources and process untrusted, uncompressed PPM images through those sources.
What is required to trigger the vulnerability?
An attacker needs a well-crafted uncompressed PPM image to be processed through an affected application's custom libvips source. Successful triggering can write up to 4032 bytes beyond an allocated heap buffer.
What should teams do to remediate the issue?
Upgrade libvips to version 8.18.3 or later. Until upgrading is possible, avoid processing untrusted uncompressed PPM images through unusual custom libvips sources.