libvips is a fast, memory-efficient image-processing library used by many applications to resize, convert, and generate thumbnails on the server. In Rails, it can power Active Storage variants, meaning uploaded images are not just stored but actively transformed before delivery.
That matters in security because server-side image processing expands the attack surface. If untrusted uploads reach libvips through a vulnerable parser or wrapper, an attacker may be able to trigger crashes, read local files, or, in some cases, reach deeper compromise. Defenders treat libvips as part of the trust boundary: they keep it patched, restrict which files and formats are accepted, and review any code path that turns user-controlled uploads into on-demand variants.