CVE-2026-70654

The CVE describes a heap buffer overflow in vips_source_read_to_memory where a VIPS_MAX/VIPS_MIN typo allows reading up to 4032 bytes past the allocated buffer when processing untrusted PPM images. The fix is one word. That's not the story. The story is that this bug lives in the core I/O abstraction layer — the canonical path for reading arbitrary input into memory — not in some obscure extension hook. The CVE's reference to 'custom libvips sources' describes the minimal trigger condition, not the everyday attack surface. Any pipeline feeding untrusted image data through libvips touches this code. What's more, the MAX/MIN inversion in buffer sizing calculations is a recurring genetic defect in C image processing code. libpng had a similar class of size miscalculation in 2019, IJG JPEG in 2015. The cognitive trap is structural: when calculating how much you can safely read, the natural language framing points toward MAX ('take as much as possible up to the limit'), but the correct operation is MIN ('don't exceed the boundary'). PPM triggers this because it's simple enough to bypass the format-checking mitigations that more complex parsers provide — exactly why it's a common fuzzing target. This means the bug likely persisted not because the code was in a shadow extension layer, but because the core source-read path wasn't being fuzzed with simple formats in the CI pipeline. The coverage gap isn't about third-party plugins; it's about the simplest parsing path being the untested one. Downstream wrappers like sharp (Node.js) and paperclip (PHP) inherit this exposure by default — the blast radius extends well beyond applications with explicit custom source handlers. For defenders: verify your libvips version is 8.18.3 or later. More importantly, audit any image processing pipeline that handles untrusted input — the presence of a low CVSS score (5.8) on a heap overflow in core I/O code should not obscure the systemic risk. The severity metric reflects the specific exploit conditions, not the practical exposure through libvips' extensive downstream ecosystem.

Reviewed through automated stages and approved by a human before publication.