CVE-2025-29769

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a "multiband" TIFF input image had 4 channels and HEIF-based output was requested, this led to libvips creating a 3 channel HEIF image without an alpha channel but then attempting to write 4 channels of data. This caused a heap buffer overflow, which could crash the process. This vulnerability is fixed in 8.16.1.

References

Affected packages

Debian:11 / vips

Package

Name: vips
Purl: pkg:deb/debian/vips?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.10.5-2+deb11u1

Affected versions

8.*

8.10.5-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / vips

Package

Name: vips
Purl: pkg:deb/debian/vips?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.14.1-3+deb12u2

Affected versions

8.*

8.14.1-3

8.14.1-3+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / vips

Package

Name: vips
Purl: pkg:deb/debian/vips?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.16.1-1

Affected versions

8.*

8.14.1-3

8.14.2-1

8.14.3-1

8.14.4-1

8.14.5-1

8.15.0~rc2-1

8.15.0~rc2-2

8.15.0-1

8.15.0-2

8.15.1-1

8.15.1-1.1~exp1

8.15.1-1.1

8.15.2-1

8.15.2-2

8.15.3-1

8.16.0-1

8.16.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/libvips/libvips

Affected ranges

Type: GIT
Repo: https://github.com/libvips/libvips
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9ab6784f693de50b00fa535b9efbbe9d2cbf71f2

Affected versions

v7.*

v7.28.0

v7.30.0

v8.*

v8.0-beta

v8.1

v8.10.0

v8.10.0-beta1

v8.10.0-beta2

v8.10.0-rc1

v8.10.0-rc2

v8.10.1

v8.10.2

v8.10.3

v8.10.4

v8.10.5

v8.10.6

v8.10.6-beta

v8.10.6-beta2

v8.11

v8.11.0

v8.11.0-rc1

v8.11.1

v8.11.2

v8.11.3

v8.11.4

v8.12.0

v8.12.0-rc1

v8.12.1

v8.12.2

v8.13.0

v8.13.0-pre1

v8.13.0-rc1

v8.13.0-rc2

v8.13.1

v8.13.2

v8.13.3

v8.14.0

v8.14.0-rc1

v8.14.1

v8.14.2

v8.14.3

v8.14.4

v8.14.5

v8.15.0

v8.15.0-rc1

v8.15.0-rc2

v8.15.1

v8.15.2

v8.15.2a

v8.15.3

v8.15.4

v8.15.4-rc1

v8.15.5

v8.15.5-rc1

v8.16.0

v8.16.0-rc1

v8.16.0-rc2

v8.2.2

v8.2.3

v8.3.0

v8.4.2

v8.5.1

v8.5.2

v8.5.3

v8.5.4

v8.5.5

v8.5.6

v8.5.7

v8.5.8

v8.5.9

v8.6.0

v8.6.0-alpha1

v8.6.0-alpha2

v8.6.0-alpha3

v8.6.0-alpha4

v8.6.0-alpha5

v8.6.0-beta1

v8.6.0-beta2

v8.6.1

v8.6.2

v8.6.3

v8.6.4

v8.7.0

v8.7.0-alpha1

v8.7.0-alpha2

v8.7.0-rc1

v8.7.0-rc2

v8.7.0-rc3

v8.7.1

v8.7.2

v8.7.3

v8.7.4

v8.8.0

v8.8.0-rc1

v8.8.0-rc2

v8.8.0-rc3

v8.8.1

v8.8.2

v8.8.3

v8.9.0

v8.9.0-alpha1

v8.9.0-beta1

v8.9.0-beta2

v8.9.0-rc1

v8.9.0-rc2

v8.9.0-rc3

v8.9.0-rc4

v8.9.1

v8.9.2