CVE-2026-35591
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Vulnerability in libvips up to version 8.18.1. The tiffload operation may incorrectly determine the number of channels in JPEG/JPEG2000 tiles within a TIFF image, leading to a buffer overflow. Fixed in version 8.18.2.
Risk Assessment
Risk includes potential remote code execution or application crash when processing images, affecting system stability.
Recommendation
Update libvips to version 8.18.2 or later and recompile applications using this library.
Other vulnerabilities in libvips
See all- CVE-2026-70654Medium
In libvips before version 8.18.3, applications using custom sources and processing untrusted PPM images can trigger a max/min error in vips_source_read_to_memory. Using VIPS_MAX instead of VIPS_MIN when selecting the read size can cause up to 4032 bytes to be written beyond the allocated buffer, leading to memory corruption or process crash.
- CVE-2026-70653Medium
In libvips before version 8.18.3, the old-style Radiance RLE decoder can process a repeat marker at the beginning of a scanline and read q[-1] before any prior pixel exists. This can disclose four bytes of adjacent heap data when loading a crafted Radiance image.
- CVE-2026-70652Low
libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.
- CVE-2026-70651Medium
In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.
- CVE-2026-69242High
libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.
- CVE-2026-35590Medium
libvips versions up to 8.18.1 have a vulnerability in the EXIF decoder. Missing range verification of EXIF tag groups can cause a null pointer dereference and crash. Fixed in version 8.18.2.
- CVE-2026-33328Medium
libvips versions up to 8.18.0 on 32-bit systems have a vulnerability in the gifload operation. Incorrect dimension determination can lead to an integer overflow. Fixed in version 8.18.1.
- CVE-2026-33327High
Vulnerability in libvips up to version 8.18.0. The vipsload operation may incorrectly determine image dimensions, leading to an integer overflow and subsequent heap-based buffer overflow. Fixed in version 8.18.1.
Original NVD description (English source)
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.