CyberRota Analysis
AI-GeneratedThe libvips image processing library prior to version 8.18.3 is vulnerable to an integer overflow due to inadequate scanline validation when processing specially crafted many-band TIFF files. This flaw can lead to unauthorized access to memory regions, potentially resulting in data disclosure or application crashes, with the possibility of remote code execution not being entirely ruled out. Organizations utilizing libvips for image processing should prioritize updating to the patched version to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3.