CVE-2026-70654

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.3

Description Applications that define unusual custom sources and process untrusted uncompressed PPM images can trigger a max/min error in the vips source read to memory() function within libvips/iofuncs/source.c. The function incorrectly uses VIPS MAX instead of VIPS MIN when selecting the remaining read size, which allows up to 4032 bytes to be written beyond the allocated heap buffer, leading to memory corruption or a process crash.

Recommendations Update to version 8.18.3.