libvips vulnerabilities in Ubuntu
Original title: USN-8994-1: libvips vulnerabilities
libvips PDF handling and integer overflow issues in Ubuntu 16.04 to 24.04 LTS could cause crashes or arbitrary code execution.
Ubuntu Security Notices detail two libvips flaws. One involves incorrect PDF file handling with a page defining width but not height, potentially causing crashes or information disclosure on Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS and 24.04 LTS. A second issue in vipsload determines image dimensions incorrectly, leading to integer overflow that might result in crashes or arbitrary code execution.
- PDF width without height issue
- vipsload integer overflow
- Affects Ubuntu 16.04 LTS to 24.04 LTS
- Possible DoS or arbitrary code execution
Impact: denial of service or arbitrary code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-59933 | libvips is a demand-driven, horizontally threaded image processing library | 5.1 | <1% | ||
| CVE-2026-33327 | libvips is a fast image processing library with low memory needs | 7.0 | <1% |
From the original article
It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.