An integer overflow in libvips’ image sanity function causes a heap buffer overflow that can read or write at negative offsets in mmap‑resident allocations. This flaw allows an attacker to craft a many‑band TIFF that, when processed with VipsForeignLoadTiff, gains access to other image data, potentially disclosing sensitive information or corrupting memory. The current advisory notes that the flaw likely causes crashes and could enable remote code execution, although no such execution has been demonstrated yet.

The vulnerability is present in the libvips library up to and including version 8.18.2. Any deployment using libvips 8.18.2 or earlier is affected; the fix is available in libvips 8.18.3 and later.

The CVSS base score of 8.4 reflects a high‑severity flaw. The EPSS score is less than 1% and the issue is not yet listed in the CISA KEV catalog, indicating it may not be widely exploited at this time. Nevertheless, the likely attack vector is the processing of a specially crafted TIFF file, which an attacker can supply to any application that loads images via libvips. The integer overflow and resulting buffer overflow make the vulnerability directly exploitable if the attacker can influence the image data or if the application processes untrusted images without strict validation.