Vulnerability · Published Sep 29, 2025 · Assigned by GitHub_M
CVE-2025-59933libvips is vulnerable to Buffer Over-Read in poppler-based pdfload
Medium 5.1
In plain English
A medium-severity security flaw in libvips from libvips. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | vips | no fix listed | DEBIAN-CVE-2025-59933 |
| Debian:13 | vips | 8.16.1-1+deb13u2 | DEBIAN-CVE-2025-59933 |
| Debian:14 | vips | 8.17.3-1 | DEBIAN-CVE-2025-59933 |
| Ubuntu:25.10 | vips | no fix listed | UBUNTU-CVE-2025-59933 |
Affected products (as reported)
Weakness: CWE-126 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
References
- https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4 x_refsource_CONFIRM
- https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1 x_refsource_MISC
- https://github.com/libvips/libvips/releases/tag/v8.17.2 x_refsource_MISC
- https://www.vicarius.io/vsociety/posts/cve-2025-59933-detect-libvips-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-59933-mitigate-libvips-vulnerability