https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T16:16:29.342340+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-70654 fkie_cve-2026-70654 2026-09-30T16:16:29.586291+00:00

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-70654 UBUNTU-CVE-2026-70654 2026-09-30T16:16:29.586422+00:00

Affected: Ubuntu:Pro:16.04:LTS: vips, Ubuntu:Pro:18.04:LTS: vips, Ubuntu:Pro:20.04:LTS: vips, Ubuntu:Pro:22.04:LTS: vips, Ubuntu:Pro:24.04:LTS: vips, Ubuntu:Pro:26.04:LTS: vips

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size, allowing up to 4032 bytes to be written beyond the allocated heap buffer and causing memory corruption or a process crash. This issue is fixed in version 8.18.3.