CyberRota Analysis
AI-GeneratedLibvips versions prior to 8.18.3, when built without libtiff support but with ImageMagick support, are vulnerable to a heap buffer over-read due to unchecked calculations while processing crafted multi-page TIFF files. This vulnerability can lead to application crashes, impacting systems relying on libvips for image processing. Users and organizations utilizing libvips in environments where libtiff is not included should prioritize upgrading to the patched version to mitigate potential disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.