In libvips prior to version 8.18.3, parsing of uncompressed PPM images via a custom source can trigger a max/min error in vips_source_read_to_memory, causing an off‑by‑one selection of remaining read size with VIPS_MAX instead of VIPS_MIN. This permits an overflow of up to 4032 bytes beyond the allocated heap buffer, resulting in memory corruption or a process crash. This flaw is a classic heap‑based buffer overflow (CWE-122) and an instance of out‑of‑bounds write (CWE-787), both of which could allow attackers to tamper with application memory or cause denial of service.

All deployments of the libvips image‑processing library older than version 8.18.3 that enable custom libvips sources for reading uncompressed PPM files are affected. This includes any application or service that links against the libvips library via the libvips:libvips package and does not enforce input validation on PPM images. The vulnerability is delivered through the libvips:libvips vendor/product family.

The CVSS score of 5.8 indicates a medium severity vulnerability. The EPSS score of 0.00114 implies a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an attacker delivering a crafted PPM image to an affected application that processes custom sources, which could be via local file uploads, network interfaces, or other input channels. Successful exploitation would allow memory corruption or cause a crash, potentially leading to arbitrary code execution or denial of service depending on the system’s configuration.