CVE-2026-70654 in libvips
Summary
by MITRE • 08/21/2026
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in libvips prior to version 8.18.3 represents a critical logic error within the image processing pipeline that leads to out-of-bounds heap memory writes. Libvips is widely utilized for its high performance and low memory footprint, making it a common dependency in web applications handling user-uploaded images. The specific flaw resides in the vips_source_read_to_memory function located in iofuncs/source.c. This component is responsible for reading data from various source types into a contiguous memory buffer. While standard usage patterns are generally safe, the vulnerability can be triggered when an application defines unusual custom libvips sources and processes untrusted uncompressed PPM images through these sources. The core technical failure stems from an incorrect comparison operator used during the calculation of the remaining read size. Specifically, the code utilizes VIPS_MAX instead of VIPS_MIN to determine how much data should be copied into the allocated buffer in a given iteration or step.
This logical inversion has severe consequences for memory safety. By using the maximum value rather than the minimum when bounding the read operation, the application fails to correctly cap the amount of data written relative to the available space in the destination heap buffer. Consequently, this allows up to 4032 bytes to be written beyond the allocated boundary. This out-of-bounds write constitutes a classic heap overflow condition. The immediate operational impact includes memory corruption, which can lead to application crashes or denial of service conditions where the process terminates unexpectedly due to invalid memory access violations. In more sophisticated attack scenarios involving crafted PPM images and custom source implementations, this memory corruption could potentially be leveraged for arbitrary code execution if an attacker can control the data written beyond the buffer boundary and manipulate adjacent heap metadata or function pointers.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing to a memory location outside of the intended buffer boundaries. It also relates to CWE-190: Integer Overflow or Wraparound in its broader context if the size calculations involved arithmetic that exceeded expected limits, though here the primary issue is logical rather than purely numeric overflow. In terms of attack vectors and techniques, this flaw can be exploited via ATT&CK technique T1203: Exploitation for Defense Evasion or potentially T1496: Resource Hijacking if used to cause denial of service through resource exhaustion caused by repeated crashes. The vulnerability highlights the risks associated with custom source implementations in image processing libraries where input validation and buffer boundary checks are not rigorously enforced against untrusted data streams.
Mitigation for this issue is straightforward and primarily involves upgrading libvips to version 8.18.3 or later, which contains the corrected logic using VIPS_MIN as intended. For applications that cannot immediately upgrade due to dependency constraints, defensive coding practices should be implemented within custom source implementations. Developers must ensure that all read operations strictly validate buffer sizes against allocated limits before performing writes. Additionally, input validation on untrusted image files is critical; while PPM images are uncompressed and thus do not suffer from parsing vulnerabilities common in complex formats like JPEG or PNG, the raw data volume they introduce requires careful handling to prevent memory exhaustion or overflow conditions during processing. Regular security audits of custom libvips source code can help identify similar logical errors where boundary checks might be incorrectly implemented using maximum values instead of minimums when determining safe copy lengths.