CVE-2026-69242
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.
Risk Assessment
Processing a malicious TIFF file can lead to data disclosure, service crashes, or potentially remote code execution, posing a serious threat to image-processing systems.
Recommendation
Upgrade libvips to version 8.18.3 or later, which includes the fix.
Other vulnerabilities in libvips
See all- CVE-2026-70654Medium
In libvips before version 8.18.3, applications using custom sources and processing untrusted PPM images can trigger a max/min error in vips_source_read_to_memory. Using VIPS_MAX instead of VIPS_MIN when selecting the read size can cause up to 4032 bytes to be written beyond the allocated buffer, leading to memory corruption or process crash.
- CVE-2026-70653Medium
In libvips before version 8.18.3, the old-style Radiance RLE decoder can process a repeat marker at the beginning of a scanline and read q[-1] before any prior pixel exists. This can disclose four bytes of adjacent heap data when loading a crafted Radiance image.
- CVE-2026-70652Low
libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.
- CVE-2026-70651Medium
In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.
- CVE-2026-35591High
Vulnerability in libvips up to version 8.18.1. The tiffload operation may incorrectly determine the number of channels in JPEG/JPEG2000 tiles within a TIFF image, leading to a buffer overflow. Fixed in version 8.18.2.
- CVE-2026-35590Medium
libvips versions up to 8.18.1 have a vulnerability in the EXIF decoder. Missing range verification of EXIF tag groups can cause a null pointer dereference and crash. Fixed in version 8.18.2.
- CVE-2026-33328Medium
libvips versions up to 8.18.0 on 32-bit systems have a vulnerability in the gifload operation. Incorrect dimension determination can lead to an integer overflow. Fixed in version 8.18.1.
- CVE-2026-33327High
Vulnerability in libvips up to version 8.18.0. The vipsload operation may incorrectly determine image dimensions, leading to an integer overflow and subsequent heap-based buffer overflow. Fixed in version 8.18.1.
Original NVD description (English source)
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3.