libvips, a lightweight image processing library, contains a bug that can cause a heap buffer over-read when a JPEG image is enlarged and then re-encoded with a gain map. The flaw arises from an undersized output buffer allocation in the function that builds the raw header for UltraHDR output. An attacker who can provide a crafted image may trigger an over-read that could expose adjacent memory contents or crash the process. The vulnerability is classified as CWE‑125 and CWE‑126, both heap-based buffer over-read weaknesses.

Versions of libvips prior to 8.18.3 that are compiled with libultrahdr support are affected. The issue is specifically triggered by pipelines that enlarge an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. Upgrading to libvips 8.18.3 or later resolves the problem.

The CVSS score of 2 indicates low severity, and the EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying that no publicly known exploit code exists. The attack vector is inferred to be via image processing, potentially exploitable by any user who can supply images to a vulnerable libvips‑based application, but effective exploitation would require constructing a specific oversized JPEG that triggers the undersized buffer allocation.