CVE-2026-70652 libvips CVE debrief

Who should care

Developers and administrators using libvips library in their applications, especially those handling large JPEG inputs, should take defensive actions to prevent potential issues. This includes verifying libvips version 8.18.3 or later is deployed, monitoring for potential issues with large JPEG inputs, and reviewing libvips library usage in their environment. Affected operator, platform, vulnerability-management, and security-team impact requires attention to ensure the security of the library.

Technical summary

libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr. This can cause a heap buffer over-read, potentially disclosing adjacent data or crashing the process. The issue arises when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. Affected product context indicates that developers and administrators using libvips library in their applications, especially those handling large JPEG inputs, should take defensive actions.

Defensive priority

Low-priority defensive review recommended due to limited attack surface and low CVSS score.

Recommended defensive actions

• Verify libvips version 8.18.3 or later is deployed
• Monitor for potential issues with large JPEG inputs
• Review libvips library usage in your environment
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. Evidence is limited; verify libvips version 8.18.3 or later is deployed. Monitor for potential issues with large JPEG inputs. Additional verification tasks are recommended to ensure the security of the library.

Official resources