This vulnerability arises from an integer overflow during the loading of multi‑page TIFF images when libvips is built without libtiff support yet retains ImageMagick support. The code that multiplies the per‑page Y‑size by the number of frames lacks bounds checking, allowing a crafted TIFF to overflow the total frame height. The overflow results in a heap buffer over‑read and a process crash, providing an attacker with a denial‑of‑service vector.

The flaw exists in libvips library versions prior to 8.18.3 when built without libtiff support but with ImageMagick support. Most package‑manager builds include libtiff and hence do not use this fallback path, so the risk is limited to custom or older builds that rely on the ImageMagick path. The fix is released in libvips 8.18.3.

The CVSS score of 6.9 reflects moderate severity, and the EPSS score is < 1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The attack requires the ability to provide a malicious multi‑page TIFF to an application that uses the affected libvips path; this could be achieved remotely in services that process user‑supplied images or locally by a user with write access to the image source.