An integer overflow occurs in the vips_extract_area_build function of libvips 8.19.0 when the extract_area argument is manipulated. The CVE description states that the attack requires local access and could be used, indicating that the vulnerability may allow a local attacker to corrupt memory managed by the image processing library. While the description does not explicitly confirm privilege escalation or arbitrary code execution, such outcomes are inferred from the potential for memory corruption and the local attacker scenario.

The affected product is libvips version 8.19.0. Any build of libvips that has not incorporated the patch identified by commit 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 remains vulnerable.

The CVSS score of 4.8 signifies moderate severity, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to supply a crafted image that triggers the overflow, so the surface for remote attackers is limited. The risk is primarily to systems that process untrusted images with a local privileged process that could be compromised if exploited.