CVE-2018-7998

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-03-09 · updated 2026-06-17
Weakness: CWE-362

Description

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.

Affected products

Debian Linux: 7.0
libvips: before 8.6.3 — fixed in 8.6.3

How to fix

Upgrade to a fixed version: libvips 8.6.3. Check the vendor advisory for mitigations.

References

https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5
https://github.com/jcupitt/libvips/issues/893
https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html
https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5
https://github.com/jcupitt/libvips/issues/893
https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html

Get alerted when CVE-2018-7998 or the next vulnerability affects your stack