The flaw resides in libvips' matrixload.c, where the function vips_foreign_load_matrix_header fails to validate a pointer before dereferencing it. When a malicious or malformed matrix header is processed, the library will crash with a null‑pointer dereference, terminating the process. The weakness corresponds to CWE‑476 and CWE‑404, and the result is a denial‑of‑service condition that disrupts any application using the library.

The security issue affects the libvips image processing library versions up to and including 8.18.0, regardless of language interface. Any application or service that links against an affected libvips binary and processes matrix files from untrusted sources is susceptible. Newer releases above 8.18.0 contain the patch that fixes the dereference bug.

The CVSS base score of 4.8 indicates a moderate impact, while an EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability requires local access to a process that loads a matrix file, so it is not remotely exploitable. It does not grant privilege escalation or data exfiltration; the primary risk is that a local attacker could cause service interruption by supplying crafted matrix data. The issue is not listed in CISA's KEV catalog.