A heap-based buffer overflow is triggered in the vips_foreign_load_csv_build function when libvips processes a specially crafted CSV file. Because the overflow corrupts adjacent heap memory, the program may crash; based on the description, it is inferred that an attacker with sufficient privileges could potentially achieve arbitrary code execution if the overflow is exploited. The vulnerability is strictly local, requiring the attacker to supply the malformed CSV input to a process that uses libvips.

All releases of libvips up to and including version 8.18.0 are affected. The issue is tied to the csvload.c component of libvips and is addressed in commit b3ab458a25e0e261cbd1788474bbc763f7435780. Users should review their installed libvips version and ensure it is updated beyond 8.18.0 or contains the patched source.

The CVSS base score of 4.8 indicates moderate risk, while the EPSS score of less than 1% signals that publicly known exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is local and requires CSV parsing, the likelihood of exploitation is limited, but the availability of public exploit code means a cautious approach is warranted.