CVE-2025-29769highCWE-122

CVE-2025-29769: high-severity vulnerability in libvips

libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output

Published · Updated

Follow this CVE+ Monitor libvips+ Monitor vips

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.3%
libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a "multiband" TIFF input image had 4 channels and HEIF-based output was requested, this led to libvips creating a 3 channel HEIF image without an alpha channel but then attempting to write 4 channels of data. This caused a heap buffer overflow, which could crash the process. This vulnerability is fixed in 8.16.1.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
libvips · libvips
Related CVEs — libvips

In the same product, most dangerous first.

CVE-2023-40032MEDIUMPotential segfault due to NULL pointer dereference in libvipsEPSS 0.3%CVE-2026-69242HIGHlibvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident writeEPSS 0.2%CVE-2025-59933MEDIUMlibvips is vulnerable to Buffer Over-Read in poppler-based pdfloadEPSS 0.2%CVE-2026-35591HIGHPossible heap-based buffer overflow when decoding TIFF image containing well-crafted tileEPSS 0.2%CVE-2026-33327HIGHPossible integer overflow leading to potential heap-based buffer overflowEPSS 0.2%CVE-2026-35590MEDIUMPossible out-of-bounds read leading to crash when decoding well-crafted EXIF metadataEPSS 0.1%