A heap-based buffer overflow occurs in the vips_source_read_to_memory function of libvips when handling custom seekable sources larger than 4 GiB. The overflow can corrupt memory in user code, leading to a crash. The vulnerability is owned by the local host, requires complex manipulation, and is difficult to exploit. The potential impact is limited to denial of service or instability in applications that rely on libvips, as the crash occurs in user space rather than the library itself.

The vulnerability affects all versions of libvips up to and including 8.19.0. It is distributed under the name libvips. No specific vendor or product hierarchy beyond the library itself is cited, and no newer versions are listed as affected in the available data.

The CVSS score is 2.0, indicating a low overall severity. The EPSS score of less than 1 % shows a very low probability of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog. Exploitation requires local access and is designated as high complexity and difficult. Attack vectors are therefore limited to trusted local environments, and the assumption of remote impact is not supported by the data.