{"id":"CVE-2025-59933","summary":"libvips is vulnerable to Buffer Over-Read in poppler-based pdfload","details":"libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.","aliases":["GHSA-q8px-4w5q-c2r4"],"modified":"2026-08-12T15:14:13.323153Z","published":"2025-09-29T22:04:09.404Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-126"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59933.json"},"references":[{"type":"WEB","url":"https://github.com/libvips/libvips/releases/tag/v8.17.2"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2025-59933-detect-libvips-vulnerability"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2025-59933-mitigate-libvips-vulnerability"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59933.json"},{"type":"ADVISORY","url":"https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59933"},{"type":"FIX","url":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libvips/libvips","events":[{"introduced":"0"},{"fixed":"0b9ea3a62477f670421868337dfaf13e8aa9d754"},{"fixed":"a58bfae9223a5466cc81ba9fe6dfb08233cf17d1"}],"database_specific":{"cpe":"cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.17.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v8.17.1","v8.17.0-rc1","v8.17.0","v8.17.0-test4","v8.17.0-test3","v8.17.0-test2","v8.17.0-test1","v8.16.0","v8.16.0-rc2","v8.16.0-rc1","v8.15.0","v8.15.0-rc2","v8.14.0","v8.14.0-rc1","v8.13.0","v8.13.0-rc2","v8.13.0-rc1","v8.13.0-pre1","v8.12.0","v8.12.0-rc1","v8.11.0","v8.11","v8.11.0-rc1","v8.10.6-beta2","v8.10.0","v8.10.0-rc2","v8.10.0-rc1","v8.10.0-beta2","v8.10.0-beta1","v8.9.0","v8.9.0-rc4","v8.9.0-rc3","v8.9.0-rc2","v8.9.0-rc1","v8.9.0-beta2","v8.9.0-beta1","v8.9.0-alpha1","v8.8.0-rc3","v8.8.0","v8.8.0-rc2","v8.8.0-rc1","v8.7.0","v8.7.0-rc3","v8.7.0-rc2","v8.7.0-rc1","v8.7.0-alpha2","v8.6.0","v8.6.0-beta2","v8.6.0-beta1","v8.6.0-alpha2","v8.6.0-alpha1","v8.5.3","v8.5.2","v8.5.1","v8.3.0","v8.2.2","v8.1","v8.0-beta","v7.28.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59933.json","vanir_signatures_modified":"2026-08-12T15:14:13Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/generate.c"},"deprecated":false,"digest":{"line_hashes":["89662197714076486723882611736913806234","311539353954297512194953542649078819598","83228934182876335717048076019954083700","40066765037772014750111718365587461846","274361096001765233592636062739364743995","213764300655672326470836164874088359096","316494691831163427196522633678917798514","57590552393377548529189596683763496652","269466085539681159416541860327844935085","144030058086672720195776176736134133704","193716957438529125115954426123425609962","107447228970295023106036783714901379449","337143850724867389642690394716838632413","303941463334540400080432023328090959668","142480460910801117787629661867673858357","167344658474688508362108303961690282651"],"threshold":0.9},"id":"CVE-2025-59933-1a53b774"},{"id":"CVE-2025-59933-1f40ab4c","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/image.c","function":"vips_image_write_prepare"},"deprecated":false,"digest":{"function_hash":"76071210998147493571044572003957335297","length":870}},{"id":"CVE-2025-59933-34c23cc8","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/generate.c","function":"vips_image_pipeline_array"},"deprecated":false,"digest":{"length":225,"function_hash":"2903784791891608802581593846329871590"}},{"id":"CVE-2025-59933-39564f87","signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/sink.c"},"deprecated":false,"digest":{"line_hashes":["300785587453691018288342421283500659843","16408169766766450223944720961380937961","224610180890158104356441182286734513050","155709564732389654069252708855563590887"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/foreign/popplerload.c"},"deprecated":false,"digest":{"line_hashes":["28728599043786369635434071433467477794","333355865688320944848089905671799444469","44848547660887070674563893650939633040","297827328456008436226332209403571756412","294051659889646977029232400323274976991","305876452504799910694560105782269487072","62781523523940142911488499583989665677","318147319443595473456500534498380104322","16911594298120891467023121928220353547","243082222846649091345228743945398603960","257446244667067420101576661100753990433","38069133477105686352603645692783155759","322812561029878926620636278388943132228","137684459131322446813885477258692422184","99075316377251641633590905662830317760","109857124669073440599524301791203644528","69847407096488085193604624656098518463","93986747479168869423928995943525304022","309490418533248709239967884197028673066","305438771284035468931403920938813051940","72977813829692303862842269706242714142"],"threshold":0.9},"id":"CVE-2025-59933-4312248f"},{"id":"CVE-2025-59933-47901329","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/object.c","function":"vips_object_sanity"},"deprecated":false,"digest":{"function_hash":"99933059745195109348708436471973370712","length":426}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/image.c","function":"vips_image_wio_input"},"deprecated":false,"digest":{"function_hash":"187251658522924119388220335840808701867","length":1556},"id":"CVE-2025-59933-5483877b"},{"id":"CVE-2025-59933-6c2b9500","signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/image.c"},"deprecated":false,"digest":{"line_hashes":["28192273716553364072652552797102288227","224498275642120571815314231483980668039","113562672155972673480214475004360297854","59044447424034831118918777004678678363","24265262126848136127036579857242638838","319739869989845219681487810092060097733","309260096504675081946133979191700074248","176590300093915475671349438037551876775","109755159996453020780604676221579610229","58114931001470300821258780449450005123","280398822721249136493725452557316049866","70981477197332901465030902984363663082","37797900454797067276435990402408228420","299306666361846475324969442990563210813","134225832652909083023645358216508166797","51526953520642433015138049375597573382","33401473914019836507488845372447968061","116812830061038018223857010210391475779","217758196333214108023386284270573702492","328433659293147957789376359232188914784","106699602156803382694289971213056335230","292525833108981792872917373856088504097","229047157770528759462545093409268572657","179025459397649329375838594581032379996","66673678365508153746123275231290488291","337347086556222922085475099436671773982","107717244247755867354128098223910709918","58142865167112748214836347199428786044","86304312634996776759243059711379564473","226841670787001324567650814170893938144","57579465720801364897836103523436063694","12628344314575061169650813044153174548","295275329388024130899999411816226972075","95458708602672591756532986578575255532","150396768649719112041438292492557418357","25368635597214005680141992871834782067","173364630322613927975201697991194138111","60624738502238030310920159684940957164","73117795381274037614814469179218419945","224022282850523662274139808367222901126","264830935324139688535112584461485066041","249708622137990061861477826040246084274","326286120089831702842392181306063111343","182618370903038713319644388451135587714","155447757729299337269232385596069825517","236373666736182780908779392043299866190","265759097172470462139413145926014680863","152867356345891587445762068686805146728","116418297422174927369276863970332397985","160217995122070949086437038405331203676","224018325171031338642775191931850944175","132557016544581934212411427168132005924","226267380791327962420345126317016942271","188779050930935876782128077966460007156"],"threshold":0.9}},{"id":"CVE-2025-59933-7139da03","signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/foreign/svgload.c"},"deprecated":false,"digest":{"line_hashes":["203737946684401437516076048033434662477","147297324410240898949956919951388146038","59350130456230881265687504003168807068","234679450871900412363991191169103932646","100908342154509175765423175256172898406","161354619184418463419797645449627013819","96534303290819074120060381331564247740","206358378409750974831531090411413915578","117616674283925514127491195122435593977","197387778699391311469018269175130033117","310173285381503154172717360362484087910","90506619553358988005890595703413823835","12972637019750531585392284723800875880"],"threshold":0.9}},{"source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/foreign/foreign.c"},"deprecated":false,"digest":{"line_hashes":["339680074312113606083540884884732141390","193461568262895952171887345968723806064","251521069942273238102968408521440916815","331051442332089940967183261002774427278","167029795099051063274458318770766729949","276861485095547731954228570881272184305","217001630694370600569443056446367561720","111813885817483091521547631485696847225","247104829711238444412045160514578720330","152901671116550352835263286127923543874","219104120881071526961335907376296834835","119899344592597136782356408504733966921","76177987786052096283694493245846381591","303795395416137674434421085887314330874","216511857815058326326984620765111000172"],"threshold":0.9},"id":"CVE-2025-59933-7b949ff8","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"function":"vips_image_sanity","file":"libvips/iofuncs/image.c"},"deprecated":false,"digest":{"length":1127,"function_hash":"141521642490517746571699340482898507898"},"id":"CVE-2025-59933-984b1278","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"function":"vips_foreign_load_start","file":"libvips/foreign/foreign.c"},"deprecated":false,"digest":{"function_hash":"232101778179724946246477369966839440958","length":820},"id":"CVE-2025-59933-9d2fcec3"},{"deprecated":false,"digest":{"line_hashes":["79471912321476852626300061898539446058","248071452371901387006478540976137655864","216850306254685933912571864159270833237","231107827945324096720062168158813964839","19304882859185724027827934034600909880","171479284297767579111268786465016523738","75339809329233704508131566770127889147","80309148391578677597444497642361467279","196882240542759767660063144616239205882","308221377142532605690260777966140317355","92247120133444344271396351872177015457","44459467839561639364122858681592273556","83192586427992636754515404917273790879","13779486082267437220884149265484461185","217020155843982787532600816653727706360","198468188411383882965088330789118141047"],"threshold":0.9},"id":"CVE-2025-59933-b69554da","signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/object.c"}},{"target":{"function":"vips_foreign_load_svg_parse","file":"libvips/foreign/svgload.c"},"deprecated":false,"digest":{"length":478,"function_hash":"118315580651469947327999923885207180485"},"id":"CVE-2025-59933-be7fc776","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1"},{"deprecated":false,"digest":{"function_hash":"11117255138726614396871695988566838195","length":814},"id":"CVE-2025-59933-c5298be9","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/image.c","function":"vips_image_pio_input"}},{"digest":{"length":720,"function_hash":"243148235596718153397446326818382640117"},"id":"CVE-2025-59933-d4988bf8","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/sink.c","function":"vips_sink_tile"},"deprecated":false},{"digest":{"function_hash":"108531414328307396767795247852332404758","length":1705},"id":"CVE-2025-59933-db84e9d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/iofuncs/generate.c","function":"vips_image_generate"},"deprecated":false},{"id":"CVE-2025-59933-edc02d47","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"file":"libvips/foreign/popplerload.c","function":"vips_foreign_load_pdf_header"},"deprecated":false,"digest":{"function_hash":"312480342103596006109144114167602367723","length":1801}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a58bfae9223a5466cc81ba9fe6dfb08233cf17d1","target":{"function":"vips_foreign_load_build","file":"libvips/foreign/foreign.c"},"deprecated":false,"digest":{"function_hash":"1055016903516905240820618081843033323","length":1742},"id":"CVE-2025-59933-f741c73d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}]}