{"id":"CVE-2019-6976","details":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","modified":"2026-08-07T16:35:31.360857Z","published":"2019-01-26T23:29:00.237Z","references":[{"type":"ADVISORY","url":"https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips/"},{"type":"ADVISORY","url":"https://github.com/libvips/libvips/releases/tag/v8.7.4"},{"type":"FIX","url":"https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libvips/libvips","events":[{"introduced":"0"},{"fixed":"849d24472eabb349b6695d3ec30d544766d32d0f"},{"fixed":"00622428bda8d7521db8d74260b519fa41d69d0a"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.7.4"}]}}],"versions":["v8.7.3","v8.7.2","v8.7.1","v8.7.0","v8.7.0-rc3","v8.7.0-rc2","v8.7.0-rc1","v8.7.0-alpha2","v8.6.0","v8.6.0-beta2","v8.6.0-beta1","v8.6.0-alpha2","v8.6.0-alpha1","v8.5.3","v8.5.2","v8.5.1","v8.3.0","v8.2.2","v8.1","v8.0-beta","v7.28.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6976.json","vanir_signatures_modified":"2026-08-07T16:35:31Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a","target":{"file":"libvips/iofuncs/memory.c"},"deprecated":false,"digest":{"line_hashes":["108279394821012556682359671896206238159","258506886015132357570460117881446573620","71423818989151498354569983222171616370","89207762862088341551540511480283008348","243898742532783699766437700216435560861","304216552808708397108966266265571731776","322544245490240379107663639445978528473","190127297607853070556653774961079082961"],"threshold":0.9},"id":"CVE-2019-6976-34f2d866","signature_type":"Line"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}