Heap Buffer Overflow Vulnerability in libvips: Critical Security Flaw
Summary
OSV-2025-131: Heap-buffer-overflow in vips_foreign_save_heif_write_block. Affects libvips versions >= 7b47b07bcd0583c4f9d4afaac85d3abb5008edff, < 68d859f9b7cc8f7d6748bfc44037e8c233b03d7b. Fixed in 68d859f9b7cc8f7d6748bfc44037e8c233b03d7b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvips is an open-source image processing library designed for high-performance image manipulation. It is widely used in various applications due to its efficiency and ability to handle large images. However, like many software libraries, it can be susceptible to vulnerabilities that may compromise its integrity and the security of applications that rely on it.
Vulnerability Detail
The vulnerability identified as OSV-2025-131 is a heap buffer overflow occurring in the function vips_foreign_save_heif_write_block. This flaw can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or crash the application. The issue was reported through OSS-Fuzz, highlighting its severity and the need for immediate attention.
How To Fix
Minimum fixed version
68d859f9b7cc8f7d6748bfc44037e8c233b03d7b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the specific functionality that triggers the vulnerability until the library is updated. This may involve modifying the application code to bypass calls to vips_foreign_save_heif_write_block.
Conclusion
The heap buffer overflow vulnerability in libvips poses a significant risk to applications utilizing this library. It is crucial for developers to update to the patched version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libvips →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, leading to memory corruption.
Exploiting this vulnerability can allow an attacker to execute arbitrary code, potentially compromising the entire application and its data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities in real-time without requiring installation.
If an immediate update is not possible, consider implementing a workaround by avoiding the use of the vulnerable function until a patch can be applied.
More information about libvips can be found on its official GitHub repository and documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvips.
