CVE-2025-59933

Katalog CVE

CVSS 7.8 · High EPSS 0,19%

Kerentanan Buffer Over-read pada libvips. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.

Rincian

Terbit di NVD

29 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-126: Buffer Over-read

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4 mitigasi · patch · advisory vendor
• https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1 patch
• https://github.com/libvips/libvips/releases/tag/v8.17.2 release notes
• https://www.vicarius.io/vsociety/posts/cve-2025-59933-detect-libvips-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-59933-mitigate-libvips-vulnerability