CVE-2026-33327
Description
A flaw was found in libvips, an image processing library. The vipsload operation, responsible for loading images, could incorrectly calculate image dimensions. This error leads to an integer overflow, which subsequently causes a heap-based buffer overflow. A local attacker with low privileges could exploit this vulnerability to execute arbitrary code or cause the application to crash, leading to a denial of service.
Statement
Important: A heap-based buffer overflow flaw in libvips' vipsload operation allows a local attacker with low privileges to achieve arbitrary code execution or cause a denial of service. This vulnerability arises from incorrect image dimension calculations, leading to an integer overflow. The impact is significant due to the potential for code execution, even with limited access.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands; Read Memory; Modify Memory
If the incorrect calculation is used in the context of memory allocation, then the software may create a buffer that is smaller or larger than expected. If the allocated buffer is smaller than expected, this could lead to an out-of-bounds read or write (CWE-119), possibly causing a crash, allowing arbitrary code execution, or exposing sensitive data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
