UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59933

Buffer over-read in poppler-based pdfload

Severity
Medium 5.1
Published
29 Sept 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.17.2
Also known as
GHSA-q8px-4w5q-c2r4
Sources
NVD, Project advisories (GitHub)

Description

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected…

Affected software

SoftwareAffected versions
libvipsServers and applications · cpe:a:libvips:libvips
  • Every version before 8.17.2
libvipsServers and applications · github:libvips/libvips
  • Every version before 8.17.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59933
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59933
  • GitHub Advisory Database https://github.com/advisories/GHSA-q8px-4w5q-c2r4
  • github.com https://github.com/libvips/libvips/security/advisories/GHSA-q8px-4w5q-c2r4