CVE-2026-70652: 
Wolfi vulnerability analysis and mitigation

CVE-2026-70652 is a heap buffer over-read vulnerability in libvips, a fast image processing library, affecting all versions prior to 8.18.3 that are compiled with libultrahdr support. The flaw exists in libvips/foreign/uhdrsave.c within the vips_foreign_save_uhdr_set_raw_hdr function, where an output buffer is incorrectly sized when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map via VipsForeignSaveUhdr. It was disclosed on August 20, 2026, and carries a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory).

The root cause is classified as CWE-126 (Buffer Over-read): the buffer allocation used image->Xsize * image->Ysize * 8 directly instead of the correct VIPS_IMAGE_N_PELS() macro, which can produce an undersized allocation when image dimensions overflow or are computed differently than expected. The fix, applied in commit cff1779, replaces the manual calculation with 8 * VIPS_IMAGE_N_PELS(image) to ensure correct buffer sizing (GitHub Commit, GitHub PR). Exploitation requires local access with low privileges and high attack complexity, as the attacker must construct a specific pipeline that first enlarges a JPEG to a very large output before triggering the UHDR gain map encoding path (GitHub Advisory).

Successful exploitation of this vulnerability can result in a heap buffer over-read, which may disclose adjacent heap memory contents (low confidentiality impact) or crash the libvips process (low availability impact). There is no integrity impact, and the vulnerability is confined to the vulnerable system with no subsequent system impact. The practical risk is limited given the specific preconditions required and the local attack vector (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-70652. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The high attack complexity and requirement for a specific image processing pipeline significantly limit practical exploitability (GitHub Advisory).

Upgrade libvips to version 8.18.3 or later, which contains the fix introduced in commit cff1779 (libvips Release). For deployments that cannot immediately upgrade, a workaround is to block the VipsForeignSaveUhdr operation using the vips_operation_block_set API, which is available in most language bindings: vips_operation_block_set("VipsForeignSaveUhdr", TRUE);. This workaround prevents the vulnerable UHDR save path from being invoked (GitHub Advisory).

The vulnerability was responsibly disclosed by Himanshu Anand and acknowledged by the libvips maintainers. The fix was reviewed and merged by project maintainer lovell on May 13, 2026, and included in the v8.18.3 release alongside several other security fixes (GitHub PR, libvips Release). No broader media coverage or notable community controversy has been observed given the low severity rating.