CVE-2023-40032mediumCWE-476

CVE-2023-40032: falha de média gravidade em libvips

Potential segfault due to NULL pointer dereference in libvips

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar libvips+ Monitorar vips

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.5epss 0.3%
libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
libvips · libvips
CVEs relacionadas — libvips

No mesmo produto, das mais perigosas para as menos.

CVE-2025-29769HIGHlibvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF outputEPSS 0.3%CVE-2026-69242HIGHlibvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident writeEPSS 0.2%CVE-2025-59933MEDIUMlibvips is vulnerable to Buffer Over-Read in poppler-based pdfloadEPSS 0.2%CVE-2026-35591HIGHPossible heap-based buffer overflow when decoding TIFF image containing well-crafted tileEPSS 0.2%CVE-2026-33327HIGHPossible integer overflow leading to potential heap-based buffer overflowEPSS 0.2%CVE-2026-35590MEDIUMPossible out-of-bounds read leading to crash when decoding well-crafted EXIF metadataEPSS 0.1%