CVE-2025-29769
published 2025-04-07CVE-2025-29769: libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel…
PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.29%
21.8th percentile
libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a "multiband" TIFF input image had 4 channels and HEIF-based output was requested, this led to libvips creating a 3 channel HEIF image without an alpha channel but then attempting to write 4 channels of data. This caused a heap buffer overflow, which could crash the process. This vulnerability is fixed in 8.16.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | vips | < vips 8.14.1-3+deb12u2 (bookworm) | vips 8.14.1-3+deb12u2 (bookworm) |
| libvips | libvips | < 8.16.1 | 8.16.1 |
| ubuntu | vips | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.5HIGH
vendor_debian8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-29769: libvips is a demand-driven, horizontally threaded image processing library
osv·2025-04-07·CVSS 8.5
CVE-2025-29769 [HIGH] CVE-2025-29769: libvips is a demand-driven, horizontally threaded image processing library
libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a "multiband" TIFF input image had 4 channels and HEIF-based output was requested, this led to libvips creating a 3 channel HEIF image without an alpha channel but then attempting to write 4 channels of data. This caused a heap buffer overflow, which could crash the process. This vulnerability is fixed in 8.16.1.
Ubuntu
libvips vulnerability
vendor_ubuntu·2026-09-14
CVE-2025-29769 libvips vulnerability
Title: libvips vulnerability
Summary: libvips could be made to crash if it opened a specially crafted file.
It was discovered that libvips incorrectly handled specially crafted TIFF
images when saving them as HEIF images. An attacker could possibly use this
issue to cause libvips to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2025-29769: vips - libvips is a demand-driven, horizontally threaded image processing library. The...
vendor_debian·2025·CVSS 8.5
CVE-2025-29769 [HIGH] CVE-2025-29769: vips - libvips is a demand-driven, horizontally threaded image processing library. The...
libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a "multiband" TIFF input image had 4 channels and HEIF-based output was requested, this led to libvips creating a 3 channel HEIF image without an alpha channel but then attempting to write 4 channels of data. This caused a heap buffer overflow, which could crash the process. This vulnerability is fixed in 8.16.1.
Scope: local
bookworm: resolved (fixed in 8.14.1-3+deb12u2)
bullseye: resolved (fixed in 8.1
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/libvips/libvips/commit/9ab6784f693de50b00fa535b9efbbe9d2cbf71f2https://github.com/libvips/libvips/pull/4392https://github.com/libvips/libvips/pull/4394https://github.com/libvips/libvips/security/advisories/GHSA-f8r8-43hh-rghmhttps://issues.oss-fuzz.com/issues/396460413https://lists.debian.org/debian-lts-announce/2025/04/msg00044.html
2025-04-07
Published