CVE-2025-59933: 
Wolfi vulnerability analysis and mitigation

CVE-2025-59933 is a buffer over-read vulnerability in libvips, a demand-driven, horizontally threaded image processing library. It affects libvips versions 8.17.1 and below when compiled with PDF input support via the poppler library. The flaw was disclosed on September 29, 2025, and fixed in version 8.17.2. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory).

The root cause is classified as CWE-126 (Buffer Over-read). The vulnerability exists in the pdfload operation's header parsing logic (vips_foreign_load_pdf_header), where the underlying poppler library does not fully validate MediaBox rectangle coordinates and returns zero for missing values — specifically when a PDF page defines a width but omits a height. This causes libvips to read beyond the intended buffer boundary when computing page dimensions. The fix (commit a58bfae) adds explicit validation to reject pages with zero or negative dimensions, returning an error before any further processing occurs. Exploitation requires a local attack vector and user interaction (i.e., a user or application must open a crafted PDF). Only builds using poppler for PDF input are affected; builds using PDFium or without PDF support are not (GitHub Advisory, Fix Commit).

Successful exploitation could result in limited confidentiality, integrity, and availability impacts on the vulnerable system. According to the advisory, processing halts very shortly after the buffer over-read occurs and no output is generated; it is not possible for a consuming application to access the overflowed memory area, which significantly limits the practical impact. The primary risk is an application crash or denial of service when processing a maliciously crafted PDF, with low potential for data exposure (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by Yang Luo and Yanju Chen of Riema Labs (GitHub Advisory, Feedly).

1. Craft a malicious PDF: Create a PDF file containing a page whose MediaBox rectangle specifies a width value but omits the height value, causing poppler to return zero for the missing dimension.
2. Deliver the PDF: Provide the crafted PDF to a target application that uses libvips (compiled with poppler support) to process PDF files — for example, an image conversion service, a web application accepting PDF uploads, or a desktop tool.
3. Trigger pdfload: Cause the application to invoke the pdfload (VipsForeignLoadPdf) operation on the malicious PDF, initiating header parsing.
4. Trigger buffer over-read: During vips_foreign_load_pdf_header, poppler returns zero for the missing height; libvips proceeds to compute page dimensions without validation, triggering a read beyond the intended buffer boundary.
5. Observe impact: The application crashes or returns an error, resulting in a denial of service. Due to the limited nature of the overflow, arbitrary code execution is not expected (GitHub Advisory, Fix Commit).

• Logs: Application error logs showing libvips errors such as "zero-sized image" or "bad dimensions" originating from the popplerload or VipsForeignLoadPdf operation when processing PDF files.
• File System: Presence of unexpected or anomalous PDF files submitted to image processing pipelines, particularly PDFs with malformed or incomplete MediaBox entries.
• Process: Unexpected crashes or abnormal termination of processes invoking libvips PDF loading functionality when handling externally supplied PDF files (GitHub Advisory).

Upgrade libvips to version 8.17.2 or later, which adds explicit validation of page dimensions in the poppler-based PDF loader (libvips Release). For those unable to upgrade immediately, two workarounds are available: (1) block the VipsForeignLoadPdf operation programmatically using vips_operation_block_set("VipsForeignLoadPdf", TRUE), available in most language bindings; or (2) set the VIPS_BLOCK_UNTRUSTED environment variable at runtime, which blocks all untrusted loaders including poppler-based PDF input. Disabling PDF input support at compile time also eliminates the attack surface entirely (GitHub Advisory).

The vulnerability was responsibly disclosed by Yang Luo and Yanju Chen of Riema Labs and acknowledged in the official libvips security advisory. The fix was released promptly in libvips 8.17.2 on September 13, 2025, prior to the CVE's public disclosure on September 29, 2025. No significant broader media coverage or notable community controversy has been observed (GitHub Advisory).