{"id":"CVE-2023-40032","aliases":["DEBIAN-CVE-2023-40032","EUVD-2023-44643","GHSA-33qp-9pq7-9584","UBUNTU-CVE-2023-40032","USN-6437-1","openSUSE-SU-2026:12266-1"],"status":"published","title":"Potential segfault due to NULL pointer dereference in libvips","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00252,"percentile":0.16739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2023-09-11T18:34:59Z","modified":"2026-10-28T10:35:09Z","fixes":[{"ecosystem":"Debian:12","package":"vips","fixed_in":["8.14.1-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vips","fixed_in":["8.14.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vips","fixed_in":["8.14.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vips","fixed_in":["8.12.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-3+deb12u1"}]}],"versions":["8.14.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.4-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1ubuntu0.1~esm1"}]}],"versions":["8.10.5-2ubuntu1","8.11.4-2","8.12.1-1","8.12.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-1ubuntu0.1~esm1"}]}],"versions":["7.40.6-2ubuntu2","8.0.2-2","8.2.1-1","8.2.2-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-1ubuntu0.1~esm1"}]}],"versions":["8.4.5-1build1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1ubuntu0.1~esm1"}]}],"versions":["8.10.5-2ubuntu1","8.11.4-2","8.12.1-1","8.12.1-1build1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.7-1.1"}]}],"bundled":9}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libvips","product":"libvips"}],"references":[{"url":"https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/libvips/libvips/pull/3604","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582b","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2/","tags":["x_transferred","Mailing List","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40032.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40032","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-40032","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-40032","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6437-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-20739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-27847","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70654","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-40032","title":"Potential segfault due to NULL pointer dereference in libvips","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","status":"published","published":"2023-09-11T18:34:59.025Z","modified":"2025-02-13T17:03:21.242Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-44643","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","status":"published","published":"2023-09-11T18:34:59Z","modified":"2025-02-13T17:03:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:49.604577Z"}],"nvd":[{"id":"CVE-2023-40032","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","status":"published","published":"2023-09-11T19:15:43.603Z","modified":"2026-06-17T06:15:51.14Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"CVE-2023-40032","title":"Potential segfault due to NULL pointer dereference in libvips","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","status":"published","published":"2023-09-11T18:34:59.025Z","modified":"2026-10-28T10:35:09.78122276Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-40032","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","status":"published","published":"2023-09-11T19:15:43.603Z","modified":"2026-10-26T18:02:31.875038907Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-40032","description":"libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.","status":"published","published":"2023-09-11T19:15:00Z","modified":"2026-04-22T14:10:01.55962Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"openSUSE-SU-2026:12266-1","title":"libvips-devel-8.18.7-1.1 on GA media","description":"These are all security issues fixed in the libvips-devel-8.18.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-24T00:00:00Z","modified":"2026-10-25T17:30:03.892254255Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"USN-6437-1","title":"vips vulnerabilities","description":"Ziqiang Gu discovered that VIPS could be made to dereference a NULL \npointer. If a user or automated system were tricked into processing \na specially crafted input image file, an attacker could possibly use\nthis issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)\n\nIt was discovered that VIPS did not properly handle uninitialized memory\nlocations when processing corrupted input image data. An attacker could \npossibly use this issue to generate output images that expose sensitive \ninformation. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2019-6976)\n\nIt was discovered that VIPS did not properly manage memory due to an \nuninitialized variable. If a user or automated system were tricked into \nprocessing a specially crafted output file, an attacker could possibly \nuse this issue to expose sensitive information. \nThis issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2020-20739)\n\nIt was discovered that VIPS could be made to divide by zero in multiple \nfuncions. If a user or automated system were tricked into processing a \nspecially crafted image file, an attacker could possibly use this issue \nto cause a denial of service. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2021-27847)\n\nIt was discovered that VIPS did not properly handle certain input files \nthat contained malformed UTF-8 characters. If a user or automated system \nwere tricked into processing a specially crafted SVG image file, an \nattacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-40032)\n","status":"published","published":"2023-10-18T14:40:28Z","modified":"2026-06-25T13:30:28.141211564Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}