Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2025-59933

libvips is a demand-driven, horizontally threaded image processing library

Risk score
52/100
CVSS
7.8 v3.1
Published
29 Sep 2025

Open in the live forecast Today's forecast

What to know

What it is
libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a hei…
Affected
Libvips before 8.17.2
Fix
Upgrade Libvips to 8.17.2 or later.
Exploitation
No known exploitation

Story map

Story map: LibvipsTHE FLAWSTHE FIXCVE-2025-59933Libvips is a demand-driven,horizontally threaded imageprocessing libraryCVSS 7.8CVE-2026-33327Libvips is a fast imageprocessing library with lowmemory needsCVSS 7.8CVE-2026-35591Libvips is a fast imageprocessing library with lowmemory needsCVSS 7.8Upgrade Libvips8.17.2 · 8.18.1 · 8.18.2or later on your release lineWho is exposedLibvips before 8.17.2YELLOW · PLAN IT INLibvipslibvips is a demand-driven,horizontally threaded imageprocessing library. For versions8.17.1 and below, when libvips iscompiled with support for PDFinput via poppler, the pdfloadoperation is affected by a…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.3 Nov · Ubuntu security noticesUSN-8994-1: libvips vulnerabilitiesCONNECTS TOSame weaknessCWE-126 (CWE-126)38 other warnings in 30 days →Same productEarlier Libvips warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Libvips: Yellow, plan it in. libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a hei…

The flaws

  • CVE-2025-59933: Libvips is a demand-driven, horizontally threaded image processing library (CVSS 7.8)
  • CVE-2026-33327: Libvips is a fast image processing library with low memory needs (CVSS 7.8)
  • CVE-2026-35591: Libvips is a fast image processing library with low memory needs (CVSS 7.8)

The fix

Upgrade Libvips: 8.17.2 · 8.18.1 · 8.18.2 or later on your release line

Who is exposed: Libvips before 8.17.2

Where it stands

  • No known exploitation

How it unfolded

  1. 3 Nov, Ubuntu security notices (official): USN-8994-1: libvips vulnerabilities

Connects to

Why it is Yellow

  • CVSS 7.8 high
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.

Last activity 3 Nov 2026. Patch Forecast updates every hour.