CyberRota Analysis
AI-GeneratedLibvips versions prior to 8.18.3, when built with libultrahdr support, are vulnerable to a heap buffer over-read due to incorrect output buffer sizing in the JPEG processing pipeline. This flaw can lead to potential data disclosure or application crashes. Users of libvips, particularly those utilizing the affected functionality, should prioritize upgrading to version 8.18.3 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.