PT-2025-39910 · Libvips+3 · Libvips+3

N0Zom1Z0 · Published 2025-09-29 · Updated 2025-12-24 · CVE-2025-59933

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libvips versions 8.17.1 and earlier

Description libvips is an image processing library. When compiled with PDF input support via poppler, versions 8.17.1 and below are susceptible to a buffer read overflow during PDF header parsing when processing a crafted PDF file lacking a height definition. Users compiling libvips without PDF input support or utilizing PDFium for PDF input are not affected. The issue is addressed in version 8.17.2. The pdfload operation is specifically impacted.

Recommendations Update to version 8.17.2 or later. Block the VipsForeignLoadPdf operation using vips operation block set. Set the VIPS BLOCK UNTRUSTED environment variable at runtime.

Exploit

Fix

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

CVE-2025-59933

GHSA-Q8PX-4W5Q-C2R4

Affected Products

Debian

Pdfium

Libvips

Poppler

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59933.json · Exploit
• https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4 · Vendor Advisory
• https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-59933 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59933 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59933 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59933 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59933 · Security Note
• https://ubuntu.com/security/CVE-2025-59933 · Vendor Advisory
• https://github.com/libvips/libvips/releases/tag/v8.17.2 · Note
• https://t.me/cveNotify/146747 · Telegram Post
• https://twitter.com/CVEnew/status/1972788807662788863 · Twitter Post
• https://t.me/cveNotify/139284 · Telegram Post
• https://vicarius.io/vsociety/posts/cve-2025-59933-detect-libvips-vulnerability · Note