CVE-2026-70653: 
Wolfi vulnerability analysis and mitigation

CVE-2026-70653 is a heap-based buffer over-read vulnerability in libvips, a fast image processing library, affecting all versions prior to 8.18.3. The flaw resides in the old-style Radiance RLE decoder (scanline_read_old in libvips/foreign/radiance.c), where a repeat marker at the very beginning of a scanline causes the decoder to read q[-1] before any pixel has been written, disclosing four bytes of adjacent heap memory. It was discovered by Himanshu Anand, responsibly disclosed, and patched on May 13, 2026 (merged PR #5037), with the fix released in v8.18.3 on June 9, 2026. The vulnerability carries a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow — specifically an out-of-bounds read). In scanline_read_old, when the very first four bytes of a scanline encode a repeat marker (RED=1, GRN=1, BLU=1), the code immediately calls copycolr(scanline[0], scanline[-1]), dereferencing one COLR element before the start of the allocated scanline buffer. This one-before-the-beginning heap read discloses four bytes of adjacent heap data. The fix adds an explicit guard: if a repeat marker is encountered when q == scanline (i.e., no prior pixel exists), the decoder returns an error instead of reading q[-1]. When ENABLE_DEPRECATED is not defined, the entire old-style path is disabled (GitHub Advisory, Fix Commit, PR #5037).

Successful exploitation allows an attacker to leak four bytes of heap memory adjacent to the scanline buffer, most likely containing other image data being processed by libvips. There is no integrity or availability impact — the vulnerability is limited to a confidentiality breach of a small amount of heap content. In contexts where libvips processes images from untrusted sources (e.g., web services, image upload pipelines), this could be used to infer information about co-resident heap allocations, though practical exploitation for sensitive data extraction is limited by the small leak size (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The vulnerability requires local access with low privileges (CVSS v4.0: AV:L/PR:L), meaning an attacker must be able to supply a crafted Radiance (.hdr) image to an application using libvips. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Craft a malicious Radiance image: Create a .hdr file using the old-style RLE encoding format where the very first four bytes of a scanline encode a repeat marker (RED=0x01, GRN=0x01, BLU=0x01, EXP=<count>), triggering the q[-1] read before any pixel has been written.
2. Deliver the image to the target: Supply the crafted .hdr file to an application that uses libvips (< 8.18.3) with Radiance support compiled in, such as via a file upload endpoint, a command-line tool, or any image processing pipeline that accepts user-supplied files.
3. Trigger decoding via VipsForeignLoadRad: The application loads the image through VipsForeignLoadRad, which calls scanline_read → scanline_read_old, triggering the out-of-bounds read of q[-1].
4. Observe leaked heap data: The four bytes read from q[-1] (one COLR element before the scanline buffer) are incorporated into the decoded image output, potentially disclosing adjacent heap content such as other image pixel data (GitHub Advisory, Fix Commit).

• File System: Presence of crafted .hdr (Radiance HDR) files with anomalous scanline headers where the first pixel encodes a repeat marker (bytes: 0x01 0x01 0x01 <count>).
• Logs: Application error logs showing rad2vips: RLE repeat at start of scanline messages (only after patching to 8.18.3; unpatched versions will silently process the malformed input).
• Process: Unexpected image processing of .hdr files from untrusted or external sources by libvips-based applications.

Upgrade libvips to version 8.18.3 or later, which includes the fix (commit dc94557) that adds a bounds check preventing the q[-1] read and optionally disables the old-style RLE path entirely when built without ENABLE_DEPRECATED. As a workaround without upgrading, block the VipsForeignLoadRad operation using vips_operation_block_set("VipsForeignLoadRad", TRUE) in application code, or set the VIPS_BLOCK_UNTRUSTED environment variable to disable all untrusted image decoders including the Radiance loader (GitHub Advisory, v8.18.3 Release).

The vulnerability was responsibly disclosed by Himanshu Anand and acknowledged by the libvips maintainers (jcupitt and lovell). The fix was reviewed and merged promptly on May 13, 2026, and included in the v8.18.3 release alongside several other security fixes. No significant broader media coverage or notable community controversy has been observed (GitHub Advisory, PR #5037).