Medium severity5.5NVD Advisory· Published Sep 11, 2023· Updated Jun 17, 2026

CVE-2023-40032

Description

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libvips/Libvips3 versions
cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*range: >=8.12.0,<8.14.4
- (no CPE)range: <=8.14.3
- (no CPE)range: < 8.14.4
Fedoraproject/Fedora
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
GitHub/libvipsllm-create
Range: <=8.14.3

Patches

Vulnerability mechanics

References

github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582bnvdPatch
github.com/libvips/libvips/pull/3604nvdPatch
github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584nvdMitigationPatchVendor Advisory
lists.fedoraproject.org/archives/list/[email protected]/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2/nvdMailing List

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000