Medium [CVE-2026-70652] Information disclosure or denial of service via heap buffer over-read when processing JPEGs with gain maps
This medium-severity Red Hat Linux advisory covers CVE-2026-70652.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr.
The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.
Moderate: This flaw in libvips, when built with libultrahdr support, could lead to information disclosure or a denial of service. Exploitation requires processing a specially crafted JPEG with gain map data, which may not be a default or common operation in all Red Hat environments.
The impact is limited to the application processing the malicious image. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H).
Weakness: CWE-125.
- < 8.18.3
Official advisory · high-confidence parse· fetched 57 minutes ago·verify at source
- 8.18.3
Official advisory · high-confidence parse· fetched 57 minutes ago·verify at source
Mitigation
Upgrade to a fixed release: 8.18.3. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 57 minutes ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.