Description
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libvips | libvips | < 8.18.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vips | 8.18.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | vips | No fix yet | — |
| Ubuntu Pro 24.04 LTS | vips | No fix yet | — |
| Ubuntu Pro 22.04 LTS | vips | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | vips | No fix yet | — |
| Ubuntu Pro 18.04 LTS | vips | No fix yet | — |
| Ubuntu Pro 16.04 LTS | vips | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | vips | 8.18.7-1.1 | openSUSE-SU-2026:12266-1 |
Advisories 1
- openSUSE-SU-2026:12266-1 libvips-devel-8.18.7-1.1 on GA media SUSE / openSUSE Security Updates · Oct 25, 2026