The critical factor here isn't exploit sophistication but where this vulnerability sits in your infrastructure. libvips is the processing engine embedded in content management systems, document conversion services, and print workflows—when it handles TIFF inputs, it maps file data directly into process memory via mmap. The integer overflow in vips_image_sanity allows negative offset access into these mapped regions, meaning an attacker can read whatever other image data happens to be adjacent in the mmap region.
The 'many-band TIFF' constraint actually concentrates the remaining risk in precisely the highest-sensitivity environments: medical imaging, satellite imagery, and archival document processing. These are exactly the domains where adjacent memory would contain your most sensitive data. The constraint narrows casual exploitability while raising the stakes for targeted attacks.
The multi-tenant exploitation vector is particularly concerning. In any server processing multiple users' image uploads concurrently, the mmap region likely contains data from different requests—an attacker inducing a server to process their crafted TIFF could read outputs from other users' operations without traditional injection.
This is the latest instantiation of a documented genealogical pattern: TIFF scanline and tile offset calculations have produced integer overflows roughly every 18-24 months across multiple implementations. Each prior CVE fixed the specific reported case, not the class. The vips_image_sanity function is defensive archaeology—layers of checks added reactively after prior sanity failures, not comprehensive protection against the integer arithmetic class.
The EPSS score of 0.00206 reflects current exploitability given the many-band constraint, not the architectural exposure. More critically, EPSS cannot measure environments where this code exists anyway—the content management system that bundles libvips transitively, the document conversion service that never processes many-band TIFF but has the library anyway.
Immediate action: isolate untrusted image processing workloads via containers, dedicated workers, or process isolation. The vulnerability exploits an architectural assumption from when libvips was designed that's now mismatched with how it's deployed. Check whether your build graph has silently extended your attack surface through dependency chains where TIFF support is a transitive feature no one owns.
The CVSS 8.4 score conveys 'high severity' but doesn't capture that this specific code path in multi-tenant or medical imaging deployments creates cross-tenant leakage risk that patches alone don't retroactively eliminate.