CVE-2023-40032

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

• CWE-476
• CWE-476

• https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582bPatch
• https://github.com/libvips/libvips/pull/3604Patch
• https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584Mitigation, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2/Mailing List
• https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582bPatch
• https://github.com/libvips/libvips/pull/3604Patch
• https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584Mitigation, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2/Mailing List

Published

Sep 11, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40027Keystone is an open source headless CMS for Node.js — built …5.3
• CVE-2023-40028Ghost is an open source content management system. Versions …6.5
• CVE-2023-40029Argo CD is a declarative continuous deployment for Kubernete…9.6
• CVE-2023-4003 One Identity Password Manager version 5.9.7.1 - An unauthen…6.8
• CVE-2023-40030Cargo downloads a Rust project’s dependencies and compiles t…6.1
• CVE-2023-40031Notepad++ is a free and open-source source code editor. Vers…7.8
• CVE-2023-40033Flarum is an open source forum software. Flarum is affected …7.1
• CVE-2023-40034Woodpecker is a community fork of the Drone CI system. In af…8.1
• CVE-2023-40035Craft is a CMS for creating custom digital experiences on th…7.2
• CVE-2023-40036Notepad++ is a free and open-source source code editor. Vers…5.5
• CVE-2023-40037Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS …6.5
• CVE-2023-40038Arris DG860A and DG1670A devices have predictable default WP…8.8