CVE-2025-59933
- Source
- https://cve.org/CVERecord?id=CVE-2025-59933
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59933.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-59933
- Aliases
-
- GHSA-q8px-4w5q-c2r4
- Downstream
- Published
- 2025-09-29T22:04:09.404Z
- Modified
- 2026-08-05T08:39:07.266312Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L CVSS Calculator
- Summary
- libvips is vulnerable to Buffer Over-Read in poppler-based pdfload
- Details
-
libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vipsoperationblockset, which is available in most language bindings, or to set VIPSBLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.
- Database specific
{ "cwe_ids": [ "CWE-126" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59933.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "fixed": "8.17.2" } ] } ] }- References
-
- https://github.com/libvips/libvips/releases/tag/v8.17.2
- https://www.vicarius.io/vsociety/posts/cve-2025-59933-detect-libvips-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-59933-mitigate-libvips-vulnerability
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59933.json
- https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4
- https://nvd.nist.gov/vuln/detail/CVE-2025-59933
- https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1
Affected packages
Git / github.com/libvips/libvips
Affected versions
v7.*
v7.28.0
v8.*
v8.0-beta
v8.1
v8.10.0
v8.10.0-beta1
v8.10.0-beta2
v8.10.0-rc1
v8.10.0-rc2
v8.10.6-beta2
v8.11
v8.11.0
v8.11.0-rc1
v8.12.0
v8.12.0-rc1
v8.13.0
v8.13.0-pre1
v8.13.0-rc1
v8.13.0-rc2
v8.14.0
v8.14.0-rc1
v8.15.0
v8.15.0-rc2
v8.16.0
v8.16.0-rc1
v8.16.0-rc2
v8.17.0
v8.17.0-rc1
v8.17.0-test1
v8.17.0-test2
v8.17.0-test3
v8.17.0-test4
v8.17.1
v8.2.2
v8.3.0
v8.5.1
v8.5.2
v8.5.3
v8.6.0
v8.6.0-alpha1
v8.6.0-alpha2
v8.6.0-beta1
v8.6.0-beta2
v8.7.0
v8.7.0-alpha2
v8.7.0-rc1
v8.7.0-rc2
v8.7.0-rc3
v8.8.0
v8.8.0-rc1
v8.8.0-rc2
v8.8.0-rc3
v8.9.0
v8.9.0-alpha1
v8.9.0-beta1
v8.9.0-beta2
v8.9.0-rc1
v8.9.0-rc2
v8.9.0-rc3
v8.9.0-rc4
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59933.json"
vanir_signatures
[
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"89662197714076486723882611736913806234",
"311539353954297512194953542649078819598",
"83228934182876335717048076019954083700",
"40066765037772014750111718365587461846",
"274361096001765233592636062739364743995",
"213764300655672326470836164874088359096",
"316494691831163427196522633678917798514",
"57590552393377548529189596683763496652",
"269466085539681159416541860327844935085",
"144030058086672720195776176736134133704",
"193716957438529125115954426123425609962",
"107447228970295023106036783714901379449",
"337143850724867389642690394716838632413",
"303941463334540400080432023328090959668",
"142480460910801117787629661867673858357",
"167344658474688508362108303961690282651"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-1a53b774",
"target": {
"file": "libvips/iofuncs/generate.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "76071210998147493571044572003957335297",
"length": 870.0
},
"id": "CVE-2025-59933-1f40ab4c",
"target": {
"function": "vips_image_write_prepare",
"file": "libvips/iofuncs/image.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "2903784791891608802581593846329871590",
"length": 225.0
},
"id": "CVE-2025-59933-34c23cc8",
"target": {
"function": "vips_image_pipeline_array",
"file": "libvips/iofuncs/generate.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"300785587453691018288342421283500659843",
"16408169766766450223944720961380937961",
"224610180890158104356441182286734513050",
"155709564732389654069252708855563590887"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-39564f87",
"target": {
"file": "libvips/iofuncs/sink.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"28728599043786369635434071433467477794",
"333355865688320944848089905671799444469",
"44848547660887070674563893650939633040",
"297827328456008436226332209403571756412",
"294051659889646977029232400323274976991",
"305876452504799910694560105782269487072",
"62781523523940142911488499583989665677",
"318147319443595473456500534498380104322",
"16911594298120891467023121928220353547",
"243082222846649091345228743945398603960",
"257446244667067420101576661100753990433",
"38069133477105686352603645692783155759",
"322812561029878926620636278388943132228",
"137684459131322446813885477258692422184",
"99075316377251641633590905662830317760",
"109857124669073440599524301791203644528",
"69847407096488085193604624656098518463",
"93986747479168869423928995943525304022",
"309490418533248709239967884197028673066",
"305438771284035468931403920938813051940",
"72977813829692303862842269706242714142"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-4312248f",
"target": {
"file": "libvips/foreign/popplerload.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "99933059745195109348708436471973370712",
"length": 426.0
},
"id": "CVE-2025-59933-47901329",
"target": {
"function": "vips_object_sanity",
"file": "libvips/iofuncs/object.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "187251658522924119388220335840808701867",
"length": 1556.0
},
"id": "CVE-2025-59933-5483877b",
"target": {
"function": "vips_image_wio_input",
"file": "libvips/iofuncs/image.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"28192273716553364072652552797102288227",
"224498275642120571815314231483980668039",
"113562672155972673480214475004360297854",
"59044447424034831118918777004678678363",
"24265262126848136127036579857242638838",
"319739869989845219681487810092060097733",
"309260096504675081946133979191700074248",
"176590300093915475671349438037551876775",
"109755159996453020780604676221579610229",
"58114931001470300821258780449450005123",
"280398822721249136493725452557316049866",
"70981477197332901465030902984363663082",
"37797900454797067276435990402408228420",
"299306666361846475324969442990563210813",
"134225832652909083023645358216508166797",
"51526953520642433015138049375597573382",
"33401473914019836507488845372447968061",
"116812830061038018223857010210391475779",
"217758196333214108023386284270573702492",
"328433659293147957789376359232188914784",
"106699602156803382694289971213056335230",
"292525833108981792872917373856088504097",
"229047157770528759462545093409268572657",
"179025459397649329375838594581032379996",
"66673678365508153746123275231290488291",
"337347086556222922085475099436671773982",
"107717244247755867354128098223910709918",
"58142865167112748214836347199428786044",
"86304312634996776759243059711379564473",
"226841670787001324567650814170893938144",
"57579465720801364897836103523436063694",
"12628344314575061169650813044153174548",
"295275329388024130899999411816226972075",
"95458708602672591756532986578575255532",
"150396768649719112041438292492557418357",
"25368635597214005680141992871834782067",
"173364630322613927975201697991194138111",
"60624738502238030310920159684940957164",
"73117795381274037614814469179218419945",
"224022282850523662274139808367222901126",
"264830935324139688535112584461485066041",
"249708622137990061861477826040246084274",
"326286120089831702842392181306063111343",
"182618370903038713319644388451135587714",
"155447757729299337269232385596069825517",
"236373666736182780908779392043299866190",
"265759097172470462139413145926014680863",
"152867356345891587445762068686805146728",
"116418297422174927369276863970332397985",
"160217995122070949086437038405331203676",
"224018325171031338642775191931850944175",
"132557016544581934212411427168132005924",
"226267380791327962420345126317016942271",
"188779050930935876782128077966460007156"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-6c2b9500",
"target": {
"file": "libvips/iofuncs/image.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"203737946684401437516076048033434662477",
"147297324410240898949956919951388146038",
"59350130456230881265687504003168807068",
"234679450871900412363991191169103932646",
"100908342154509175765423175256172898406",
"161354619184418463419797645449627013819",
"96534303290819074120060381331564247740",
"206358378409750974831531090411413915578",
"117616674283925514127491195122435593977",
"197387778699391311469018269175130033117",
"310173285381503154172717360362484087910",
"90506619553358988005890595703413823835",
"12972637019750531585392284723800875880"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-7139da03",
"target": {
"file": "libvips/foreign/svgload.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"339680074312113606083540884884732141390",
"193461568262895952171887345968723806064",
"251521069942273238102968408521440916815",
"331051442332089940967183261002774427278",
"167029795099051063274458318770766729949",
"276861485095547731954228570881272184305",
"217001630694370600569443056446367561720",
"111813885817483091521547631485696847225",
"247104829711238444412045160514578720330",
"152901671116550352835263286127923543874",
"219104120881071526961335907376296834835",
"119899344592597136782356408504733966921",
"76177987786052096283694493245846381591",
"303795395416137674434421085887314330874",
"216511857815058326326984620765111000172"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-7b949ff8",
"target": {
"file": "libvips/foreign/foreign.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "141521642490517746571699340482898507898",
"length": 1127.0
},
"id": "CVE-2025-59933-984b1278",
"target": {
"function": "vips_image_sanity",
"file": "libvips/iofuncs/image.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "232101778179724946246477369966839440958",
"length": 820.0
},
"id": "CVE-2025-59933-9d2fcec3",
"target": {
"function": "vips_foreign_load_start",
"file": "libvips/foreign/foreign.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"79471912321476852626300061898539446058",
"248071452371901387006478540976137655864",
"216850306254685933912571864159270833237",
"231107827945324096720062168158813964839",
"19304882859185724027827934034600909880",
"171479284297767579111268786465016523738",
"75339809329233704508131566770127889147",
"80309148391578677597444497642361467279",
"196882240542759767660063144616239205882",
"308221377142532605690260777966140317355",
"92247120133444344271396351872177015457",
"44459467839561639364122858681592273556",
"83192586427992636754515404917273790879",
"13779486082267437220884149265484461185",
"217020155843982787532600816653727706360",
"198468188411383882965088330789118141047"
],
"threshold": 0.9
},
"id": "CVE-2025-59933-b69554da",
"target": {
"file": "libvips/iofuncs/object.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "118315580651469947327999923885207180485",
"length": 478.0
},
"id": "CVE-2025-59933-be7fc776",
"target": {
"function": "vips_foreign_load_svg_parse",
"file": "libvips/foreign/svgload.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "11117255138726614396871695988566838195",
"length": 814.0
},
"id": "CVE-2025-59933-c5298be9",
"target": {
"function": "vips_image_pio_input",
"file": "libvips/iofuncs/image.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "243148235596718153397446326818382640117",
"length": 720.0
},
"id": "CVE-2025-59933-d4988bf8",
"target": {
"function": "vips_sink_tile",
"file": "libvips/iofuncs/sink.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "108531414328307396767795247852332404758",
"length": 1705.0
},
"id": "CVE-2025-59933-db84e9d0",
"target": {
"function": "vips_image_generate",
"file": "libvips/iofuncs/generate.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "312480342103596006109144114167602367723",
"length": 1801.0
},
"id": "CVE-2025-59933-edc02d47",
"target": {
"function": "vips_foreign_load_pdf_header",
"file": "libvips/foreign/popplerload.c"
},
"deprecated": false
},
{
"source": "https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "1055016903516905240820618081843033323",
"length": 1742.0
},
"id": "CVE-2025-59933-f741c73d",
"target": {
"function": "vips_foreign_load_build",
"file": "libvips/foreign/foreign.c"
},
"deprecated": false
}
]
vanir_signatures_modified
"2026-08-05T08:39:07Z"