CVE-2026-70652

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.3

Description When built with libultrahdr support, the library can incorrectly size an output buffer within the vips foreign save uhdr set raw hdr() function in libvips/foreign/uhdrsave.c. This occurs when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The resulting undersized allocation can lead to a heap buffer over-read, which may cause a process crash or the disclosure of adjacent data.

Recommendations Update to version 8.18.3.