The vulnerability originates from the EXIF decoder in libvips, which passes EXIF tag data to libexif without verifying the tag group range. This omission can produce a null pointer dereference that crashes the library, resulting in a denial-of-service condition for any service that uses libvips to decode image files. The weakness is a classic out-of-bounds buffer read described by CWE‑122.

The affected product is the libvips image processing library. All releases of libvips prior to and including version 8.18.1 are vulnerable. The security patch is incorporated in libvips 8.18.2 and later releases.

The CVSS score of 6.8 indicates moderate severity. The EPSS score, reported as < 1%, signifies a very low but non‑zero probability of exploitation in the current landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by delivering a crafted image that contains malicious EXIF metadata to an application that uses libvips for decoding. Because the flaw leads to a crash rather than arbitrary code execution, the principal impact is a denial-of-service condition affecting the process or service that relies on libvips.