vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow.This vulnerability is handled as CVE-2026-2913. It is possible to launch the attack on the local host. Additionally, an exploit exists.
Applying a patch is the recommended action to fix this issue.
The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."