CVE-2026-70652

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70652", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-04T21:48:08.612Z", "datePublished": "2026-08-20T21:04:51.898Z", "dateUpdated": "2026-08-21T21:45:43.586Z"}, "containers": {"cna": {"title": "libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map", "problemTypes": [{"descriptions": [{"cweId": "CWE-126", "lang": "en", "description": "CWE-126: Buffer Over-read", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg"}, {"name": "https://github.com/libvips/libvips/pull/5039", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/pull/5039"}, {"name": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8"}, {"name": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3"}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"version": "< 8.18.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:04:51.898Z"}, "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3."}], "source": {"advisory": "GHSA-h27h-jf9v-m8rg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T20:58:36.766334Z", "id": "CVE-2026-70652", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:45:43.586Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70652", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T20:58:36.766334Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T20:58:38.092Z"}}], "cna": {"title": "libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map", "source": {"advisory": "GHSA-h27h-jf9v-m8rg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}], "references": [{"url": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg", "name": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libvips/libvips/pull/5039", "name": "https://github.com/libvips/libvips/pull/5039", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8", "name": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "name": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126: Buffer Over-read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:04:51.898Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70652", "state": "PUBLISHED", "dateUpdated": "2026-08-21T21:45:43.586Z", "dateReserved": "2026-08-04T21:48:08.612Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:04:51.898Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libvips", "vendor": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3."}, {"lang": "es", "value": "libvips es una biblioteca de procesamiento de im\u00e1genes r\u00e1pida con bajas necesidades de memoria. Antes de la versi\u00f3n 8.18.3, libvips compilado con soporte para libultrahdr puede dimensionar incorrectamente un b\u00fafer de salida en libvips/foreign/uhdrsave.c dentro de vips_foreign_save_uhdr_set_raw_hdr cuando una tuber\u00eda agranda un JPEG entrante a una salida muy grande antes de codificar un mapa de ganancia a trav\u00e9s de VipsForeignSaveUhdr. La asignaci\u00f3n de tama\u00f1o insuficiente puede causar una lectura excesiva del b\u00fafer de pila que puede revelar datos adyacentes o bloquear el proceso. Este problema est\u00e1 solucionado en la versi\u00f3n 8.18.3."}], "id": "CVE-2026-70652", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70652", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T20:58:36.766334Z", "version": "2.0.3"}}]}, "published": "2026-08-20T21:17:08.270", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/pull/5039"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-126"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libvips: libvips: Information disclosure or denial of service via heap buffer over-read when processing JPEGs with gain maps", "id": "2520799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520799"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.", "A flaw was found in libvips, an image processing library. When libvips is built with libultrahdr support, it can incorrectly size an output buffer during the process of enlarging an incoming JPEG to a very large output before encoding a gain map. This undersized allocation can lead to a heap buffer over-read, potentially disclosing adjacent memory data or causing the application to crash, resulting in a denial of service."], "name": "CVE-2026-70652", "public_date": "2026-08-20T21:04:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-70652\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-70652\nhttps://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8\nhttps://github.com/libvips/libvips/pull/5039\nhttps://github.com/libvips/libvips/releases/tag/v8.18.3\nhttps://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg"], "statement": "Moderate: This flaw in libvips, when built with libultrahdr support, could lead to information disclosure or a denial of service. Exploitation requires processing a specially crafted JPEG with gain map data, which may not be a default or common operation in all Red Hat environments. The impact is limited to the application processing the malicious image.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.18.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libvips", "source": "cna", "vendor": "libvips"}, "product": "libvips", "vendor": "libvips"}], "created": "2026-08-20T23:30:06.970780+00:00", "updated": "2026-08-31T14:30:09.020491+00:00", "vendors": ["libvips", "libvips$PRODUCT$libvips"]}