A local attacker can manipulate the index argument to the vips_bandrank_build function in libvips, causing a heap‑based buffer overflow. The vulnerability may corrupt heap memory, leading to crashes, denial of service, or potentially arbitrary code execution if the memory layout permits influence over control data. The flaw is limited to local exploitation but the exploit code is publicly available.

The issue affects installations of libvips version 8.19.0. Systems that have this version without the patch are vulnerable; newer releases are assumed to contain the fix.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1 % suggests that attacks are currently unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access, but the presence of a public exploit and the buffer overrun make it a potentially high‑impact risk if an attacker can gain local privileges or run untrusted code on the system.