CVE-2025-29769 libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output
A heap buffer overflow in libvips allows attackers to crash the application by processing a crafted multiband TIFF image for HEIF conversion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29769?
CVE-2025-29769 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 7 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is possible with a well-crafted TIFF image. If a "multiband" TIFF input image had 4 channels and HEIF-based output was requested, this led to libvips creating a 3 channel HEIF image without an alpha channel but then attempting to write 4 channels of data. This caused a heap buffer overflow, which could crash the process. This vulnerability is fixed in 8.16.1.
Weakness: CWE-122
Which versions are affected by CVE-2025-29769?
It affects 2 products.
Products include Debian Debian Linux, Libvips Libvips.
How do I fix CVE-2025-29769?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-29769 being exploited?
There is no known exploitation of CVE-2025-29769 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2025-29769, DLA-4148-1, DSA-5915-1, GHSA-f8r8-43hh-rghm, UBUNTU-CVE-2025-29769, USN-8755-1.