A heap-based buffer overflow occurs in the function im_minpos_vec located in libvips/deprecated/vips7compat.c. An attacker who can influence the argument n can cause the function to write past the bounds of a dynamically allocated buffer, potentially corrupting adjacent heap objects. The vulnerability is limited to local use, but local corruption can lead to application crashes or may lead to arbitrary code execution under certain conditions. Based on the description, it is inferred that arbitrary code execution could be achieved if the heap overwrite is leveraged properly, though the vulnerability statement itself does not explicitly confirm this capability.

Versions of libvips up to and including 8.18.2 are affected. The vulnerability resides in the deprecated nip2 handler. A newer release (8.19) will remove the deprecated code path, removing the vulnerability.

The CVSS score of 4.8 places the vulnerability in the moderate range. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation at the time. Because an attacker must have local access to the system running libvips, the risk is primarily to environments where untrusted users can invoke libvips; however, local exploitation can still lead to service disruption or may allow privilege escalation if the heap overwrite is leveraged carefully.