UpHeron
All vulnerabilities

Servers and applications

CVE-2025-29769

Potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output

Severity
High 8.5
Published
7 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.16.1
Also known as
GHSA-f8r8-43hh-rghm
Sources
NVD, Project advisories (GitHub)

Description

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a…

Affected software

SoftwareAffected versions
libvipsServers and applications · cpe:a:libvips:libvips
  • Every version before 8.16.1
libvipsServers and applications · github:libvips/libvips
  • Every version before 8.16.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-29769
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-29769
  • GitHub Advisory Database https://github.com/advisories/GHSA-f8r8-43hh-rghm
  • github.com https://github.com/libvips/libvips/security/advisories/GHSA-f8r8-43hh-rghm