libvips Buffer Overflow Vulnerability in TIFF Load Operation

A heap-based buffer overflow vulnerability has been identified in libvips, a fast image processing library, in versions through 8.18.1. The issue arises in the 'tiffload' operation, where the library could incorrectly assess the number of channels in JPEG or JPEG2000-encoded tiles within TIFF images. This miscalculation can lead to a buffer overflow.

Impact

Exploitation of this vulnerability could result in a heap-based buffer overflow, a common vulnerability type that can lead to arbitrary code execution or memory corruption.

Remediation

Users can update to libvips version 8.18.2 or later, where this vulnerability has been patched. Alternatively, the 'VipsForeignLoadTiff' operation can be blocked using 'vips_operation_block_set', available in most language bindings.