CVE-2023-40032: Fedoraproject Fedora

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

Affected products

• Fedoraproject Fedora: version 39 only
• Libvips Libvips: from 8.12.0, before 8.14.4 (fixed in 8.14.4)

Published 2023-09-11. Last modified 2026-06-17.