CVE-2026-70652

{
  "id": "CVE-2026-70652",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-20T21:17:08.270",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3."
    },
    {
      "lang": "es",
      "value": "libvips es una biblioteca de procesamiento de imágenes rápida con bajas necesidades de memoria. Antes de la versión 8.18.3, libvips compilado con soporte para libultrahdr puede dimensionar incorrectamente un búfer de salida en libvips/foreign/uhdrsave.c dentro de vips_foreign_save_uhdr_set_raw_hdr cuando una tubería agranda un JPEG entrante a una salida muy grande antes de codificar un mapa de ganancia a través de VipsForeignSaveUhdr. La asignación de tamaño insuficiente puede causar una lectura excesiva del búfer de pila que puede revelar datos adyacentes o bloquear el proceso. Este problema está solucionado en la versión 8.18.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "libvips",
          "product": "libvips",
          "versions": [
            {
              "version": "< 8.18.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.0,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T20:58:36.766334Z",
          "id": "CVE-2026-70652",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-126"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libvips/libvips/pull/5039",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg",
      "source": "[email protected]"
    }
  ]
}