Back to Database
Status published
Medium
CVE-2023-40032
Potential segfault due to NULL pointer dereference in libvips
Vulnerability Description
libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40032
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584
- https://github.com/libvips/libvips/pull/3604
- https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582b
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2/
More from libvips
View All →CVE-2025-59933
libvips is vulnerable to Buffer Over-Read in poppler-based pdfload
Medium
5.1
CVE-2025-29769
libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output
High
8.5
CVE-2021-27847
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83,...
Medium
6.5
CVE-2020-20739
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized...
Medium
5.3
CVE-2019-6976
libvips before 8.7.4 generates output images from uninitialized memory locations...
Medium
5.3
Affected Vendor
libvips
View all reports →Affected Software
libvips
Vulnerable Versions:
< 8.14.4
Timeline
Official Publish:
September 11th, 2023
Last Modified:
February 13th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H