libvips up to 8.17.1 PDF vips_operation_block_set buffer over-read

Summaryinfo

A vulnerability classified as critical was found in libvips up to 8.17.1. This vulnerability affects the function vips_operation_block_set of the component PDF Handler. The manipulation results in buffer over-read. This vulnerability is known as CVE-2025-59933. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in libvips up to 8.17.1. Affected is the function vips_operation_block_set of the component PDF Handler. The manipulation with an unknown input leads to a buffer over-read vulnerability. CWE is classifying the issue as CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-59933 since 09/23/2025. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 266347 (Linux Distros Unpatched Vulnerability : CVE-2025-59933), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.17.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch a58bfae9223a5466cc81ba9fe6dfb08233cf17d1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (266347). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• libvips

Version

• 8.17.0
• 8.17.1

License

• open-source

Website

• Product: https://github.com/libvips/libvips/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion