A flaw in libvips’ old‑style Radiance RLE decoder allows the decoder to read before any pixel data has been initialized when a scanline starts with a repeat marker. The code accesses a memory location that holds four bytes of adjacent heap data, which may contain other image data or unrelated information. The read can leak these bytes to the application, resulting in a modest information disclosure.

The vulnerability exists in libvips older than version 8.18.3. Any software that uses the foreign Radiance loader to import RLE images is potentially exposed. The issue is fixed in libvips 8.18.3 and later.

The CVSS base score is 4.8, reflecting a medium impact with limited severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation yet. The most likely attack vector is a local or remote application that imports a crafted Radiance image; by supplying such a file, an attacker can gain a few bytes of unintended data. Overall, the risk is moderate but the lack of active exploitation makes it a low‑to‑moderate priority.