Heap Buffer Overflow in libvips Due to Incorrect Alpha Channel Interpretation

CVE-2025-29769

What is CVE-2025-29769?

The libvips image processing library has a vulnerability that arises during the heifsave operation, where it may inaccurately assess the presence of an alpha channel in certain multiband TIFF images. This can lead to a situation where a 3-channel HEIF image is mistakenly created without an alpha channel, while simultaneously attempting to write 4 channels of data. Consequently, this mismatch results in a heap buffer overflow, potentially crashing the process. The issue has been addressed in version 8.16.1 of the library.

References