CVE-2026-70654: 
Wolfi vulnerability analysis and mitigation

CVE-2026-70654 is a heap-based buffer overflow vulnerability in libvips, a fast image processing library, affecting all versions prior to 8.18.3. The flaw exists in the vips_source_read_to_memory function in libvips/iofuncs/source.c, where a copy-paste typo causes VIPS_MAX to be used instead of VIPS_MIN when calculating the remaining read size, allowing up to 4,032 bytes to be written beyond the allocated heap buffer. The vulnerability was discovered by Himanshu Anand, disclosed responsibly, and fixed on May 13, 2026, with the security advisory published on August 14, 2026. It carries a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory).

The root cause is a copy-paste typo classified as CWE-122 (Heap-based Buffer Overflow): in libvips/iofuncs/source.c at line 978, the expression VIPS_MAX(4096, source->length - read_position) should be VIPS_MIN(4096, source->length - read_position). Using VIPS_MAX causes the read size to be the larger of 4096 or the remaining bytes, which can exceed the allocated buffer when processing near the end of a source stream. Exploitation requires an attacker to supply a maliciously crafted uncompressed PPM image to an application that has defined a custom libvips source (an unusual configuration), and the attacker must have low-level privileges on the system. No public proof-of-concept exploit code has been identified (GitHub Advisory, Fix Commit).

Successful exploitation can result in memory corruption or a process crash (denial of service), with a secondary possibility of arbitrary code execution depending on heap layout and attacker control over the overflow content. The primary impact is high availability loss to the affected process, with a low integrity impact due to potential unauthorized memory modification; confidentiality is not directly impacted. The vulnerability is scoped to the vulnerable system only, with no assessed impact on subsequent systems (GitHub Advisory).

No public exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-70654. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement for a custom libvips source definition (described as "highly unusual") and local access with low privileges, significantly limiting the practical attack surface (GitHub Advisory).

1. Identify target application: Locate an application that uses libvips with a custom-defined VipsSource (not the standard file or memory sources) and processes untrusted PPM images — this is a rare configuration.
2. Craft malicious PPM image: Create an uncompressed PPM image designed so that when read via the custom source, the vips_source_read_to_memory function is triggered near the end of the buffer, causing the VIPS_MAX logic to request a read size larger than the remaining allocated buffer.
3. Submit the image: Supply the crafted PPM file to the target application through whatever input mechanism it exposes (e.g., file upload, API endpoint, local file path).
4. Trigger heap overflow: The vulnerable vips_source_read call writes up to 4,032 bytes beyond the allocated heap buffer, causing memory corruption.
5. Achieve objective: Depending on heap layout and application specifics, the outcome may be a process crash (denial of service) or, in a more controlled scenario, potential arbitrary code execution (GitHub Advisory, Fix Commit).

• Logs: Application crash logs or core dumps originating from the libvips process, particularly referencing vips_source_read_to_memory or PPM image loading operations.
• Process: Unexpected termination (segmentation fault, SIGABRT) of processes using libvips when handling PPM image input via custom sources.
• File System: Presence of unusual or malformed .ppm files in directories monitored by the application; core dump files generated by the libvips-linked process.

Upgrade libvips to version 8.18.3 or later, which contains the one-line fix replacing VIPS_MAX with VIPS_MIN in source.c (libvips Release). For those unable to upgrade immediately, two workarounds are available: block the VipsForeignLoadPpm operation programmatically using vips_operation_block_set("VipsForeignLoadPpm", TRUE), or set the VIPS_BLOCK_UNTRUSTED environment variable to disable all untrusted image decoders including the PPM loader. These workarounds are available in most libvips language bindings (GitHub Advisory).

The vulnerability was responsibly disclosed by Himanshu Anand and credited in both the fix commit and the official security advisory. The libvips maintainer (jcupitt) described the root cause as a "copy-paste typo" and merged the fix promptly on May 13, 2026. No significant broader media coverage or notable community debate has been identified beyond the GitHub advisory and pull request (GitHub Advisory, Fix PR).