A memory access issue exists in libvips 8.19.0 when decoding little‑endian PFM images. If the textual header length is not a multiple of four bytes, the mmap‑based loader exposes pixel data at an unaligned address. The subsequent float dereference in the vips_avg_scan() routine triggers undefined behavior, terminating the process on architectures that enforce strict alignment or on builds instrumented with UBSan. This results in a denial of service for the application processing the malicious image.

The vulnerability affects any installation of libvips 8.19.0 that processes PFM files. Applications running on Linux, macOS, or Windows that employ this library version are vulnerable if they accept PFM inputs. Versions prior to or after 8.19.0 are not listed as affected.

The CVSS score of 7.5 indicates a high severity denial of service vulnerability. The EPSS score is below 1%, showing a low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. An attacker can trigger the flaw by supplying a crafted PFM file, making the risk local to the process that ingests the image. While it does not provide code execution, repeated crashes could disrupt services or be used as part of a broader attack.