Listen to this Post
libvips is a fast image processing library designed for efficiency and low memory usage. The `vipsload` operation in versions 8.18.0 and earlier contains a logic flaw that causes the library to incorrectly determine image dimensions when parsing VIPS (.vips) files. This incorrect dimension calculation triggers an integer overflow (CWE-190), which subsequently leads to a heap-based buffer overflow.
The vulnerability is rooted in how libvips computes the memory allocation size for incoming image data. When a specially crafted VIPS image file with malformed dimension metadata is processed, the size calculation overflows, resulting in an undersized heap buffer allocation. The subsequent write operation then writes data beyond the allocated buffer boundaries, corrupting adjacent heap memory.
An attacker can exploit this vulnerability by supplying a malicious VIPS image to an application that uses the vulnerable libvips library. The heap corruption can cause the application to crash, leading to denial of service. In more severe scenarios, an attacker may be able to achieve arbitrary code execution by carefully crafting the overflow to overwrite critical heap metadata or function pointers.
This vulnerability has been patched in libvips version 8.18.1. The fix, implemented in commit 61e71c13328ed72d0a530dffc19b9b225072bdf9, corrects the dimension validation logic to prevent the integer overflow.
The vulnerability was responsibly disclosed by security researcher Elhanan Haenel. It affects a wide range of libvips versions, from as early as v7.28.0 through v8.18.0. Due to libvips being a popular dependency in many image processing applications and Node.js packages like sharp, this vulnerability has widespread implications.
DailyCVE Form:
Platform: libvips
Version: ≤8.18.0
Vulnerability: Heap Buffer Overflow
Severity: High (7.0)
date: 2026-07-20
Prediction: 2026-07-22 (patch available)
What Undercode Say:
Check libvips version
vips --version
Check if system is vulnerable (Debian/Ubuntu)
apt policy libvips
Check if system is vulnerable (RHEL/CentOS)
rpm -q libvips
Block the vulnerable operation via environment variable
export VIPS_BLOCK_UNTRUSTED=1
Block the vulnerable operation via command line
vips_operation_block_set("VipsForeignLoadVips", TRUE)
Exploit: (Educational Purposes!)
Educational PoC - CVE-2026-33327
This demonstrates the vulnerability concept, not a working exploit
import struct
def create_malicious_vips():
Craft a VIPS header with malformed dimensions
The goal: cause integer overflow in size calculation
width height channels exceeds 32-bit integer range
width = 0xFFFFFFFF Max 32-bit value
height = 0xFFFFFFFF
bands = 4 RGBA
This would cause width height bands to overflow
leading to undersized heap allocation
header = struct.pack('>IIII', width, height, bands, 0)
return header + b'A' 1024 Overflow data
Save malicious file
with open('malicious.vips', 'wb') as f:
f.write(create_malicious_vips())
Protection:
1. Upgrade libvips to version 8.18.1 or later.
2. Block the vulnerable operation using `vips_operation_block_set(“VipsForeignLoadVips”, TRUE)`.
- Set the environment variable `VIPS_BLOCK_UNTRUSTED=1` to prevent all untrusted image decoders.
- If using Node.js sharp, upgrade to version 0.35.0 or later.
Impact:
Successful exploitation can lead to application crashes (denial of service) or, in more severe cases, arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
