CVE-2026-70654
Description
A flaw was found in libvips, an image processing library. When applications process untrusted uncompressed PPM (Portable Pixmap) images through unusual custom libvips sources, a heap buffer overflow can occur. This vulnerability, located in the vips_source_read_to_memory function, allows a local attacker to write beyond an allocated memory buffer. This can lead to memory corruption or cause the application to crash, resulting in a denial of service.
Statement
This Moderate impact flaw in libvips involves a heap buffer overflow when processing untrusted uncompressed PPM images through applications configured with unusual custom libvips sources. Exploitation requires a specific, non-default application setup and user interaction, which reduces the overall risk in typical Red Hat environments. The vulnerability can lead to memory corruption or application crashes.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
