Variant processing is the server-side step that creates resized, cropped, reformatted, or otherwise transformed versions of uploaded files. Web apps use it for thumbnails, previews, and device-specific images, often through libraries such as libvips or ImageMagick. The original upload is not just stored; it is parsed and manipulated by code running on the server.
This matters because image and document parsers are exposed to untrusted input. A crafted file can trigger memory corruption, file reads, or other unsafe behavior inside the processing backend, turning a convenience feature into an attack surface. In real defenses, teams limit which processors are enabled, keep image libraries patched, avoid passing attacker-controlled transformation parameters, and isolate file handling from sensitive secrets. If variant processing is compromised, the impact can extend beyond broken thumbnails to data exposure or, in some environments, code execution.