← Vulnerability feed

Vulnerability record · CVE-2025-59933 · published 29 September 2025

CVE-2025-59933: Libvips vulnerability

Libvips · Libvips

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.

5.1 CVSS 4.0 Medium EPSS 0.19% · top 92.4% CWE-126 · CWE-126
5.1CVSS 4.0 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1 Patch
https://github.com/libvips/libvips/releases/tag/v8.17.2 Release Notes
https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4 MitigationPatchVendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-59933-detect-libvips-vulnerability
https://www.vicarius.io/vsociety/posts/cve-2025-59933-mitigate-libvips-vulnerability

Track CVE-2025-59933 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2019-17534Libvips use after free vulnerabilityvips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to …EPSS 2.4%8.5CVE-2025-29769Libvips heap-based buffer overflow vulnerabilitylibvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alp…EPSS 0.28%7.5CVE-2018-7998Libvips race condition vulnerabilityIn libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows r…EPSS 1.8%7.0CVE-2026-35591Libvips heap-based buffer overflow vulnerabilitylibvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could inco…EPSS 0.18%7.0CVE-2026-33327Libvips integer overflow vulnerabilitylibvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly …EPSS 0.18%6.8CVE-2026-35590Libvips heap-based buffer overflow vulnerabilitylibvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verify…EPSS 0.15%6.8CVE-2026-33328Libvips integer overflow vulnerabilitylibvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation …EPSS 0.15%6.5CVE-2021-27847Libvips divide by zero vulnerabilityDivision-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.EPSS 0.98%

Source: NIST National Vulnerability Database (record CVE-2025-59933), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.