The vulnerability resides in libvips, version 8.18.0 or earlier, in the matrixload.c component that processes matrix file headers. An attacker who can execute code locally on a system that uses libvips can manipulate matrix file contents to trigger a memory corruption condition via the function vips_foreign_load_matrix_header. The resulting corruption could overwrite critical data structures and potentially lead to crashes or arbitrary code execution, compromising the integrity of the affected process.

Affected systems include any installation of the libvips library up to and including version 8.18.0 that uses the foreign matrix load functionality. The fix is applied in commit d4ce337c76bff1b278d7085c3c4f4725e3aa6ece and is present in releases thereafter. Users of older versions should compare installed versions against the first patch tarball that includes this commit.

The CVSS score of 4.8 places the weakness in the moderate range, and the EPSS value of less than 1 percent indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is strictly local, meaning threat actors need local access to the machine running libvips. Consequently, the overall risk is moderate but constrained to environments where untrusted matrix files could be processed by privileged local users.