On 32‑bit platforms, libvips versions up through 8.18.0 incorrectly compute GIF image dimensions during the gifload operation, causing an integer overflow in a memory‑allocation routine. This flaw, classified as CWE‑190, can overwrite memory or force the program to terminate. The vulnerability arises only when processing GIF files supplied to the affected libvips build, and the overflow occurs during the initial decoding of the image header.

All installations of libvips 8.18.0 or earlier running on 32‑bit systems are vulnerable. Any application that loads GIF images using these libvips versions is at risk, regardless of the programming language that interfaces with the library.

The CVSS score of 6.8 signals a moderate severity, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation. An attacker would need to supply a specially crafted GIF file to trigger the overflow; the exploit does not grant privileged execution but could lead to denial of service or, if the GIF processor runs with elevated privileges, possibly arbitrary code execution. The vulnerability is not listed in the CISA KEV catalog.