CVE-2026-70652
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.
Risk Assessment
The vulnerability may disclose adjacent data or crash the process, potentially leading to information leakage or denial of service.
Recommendation
Upgrade to version 8.18.3, which contains the fix.
Other vulnerabilities in libvips
See all- CVE-2026-70654Medium
In libvips before version 8.18.3, applications using custom sources and processing untrusted PPM images can trigger a max/min error in vips_source_read_to_memory. Using VIPS_MAX instead of VIPS_MIN when selecting the read size can cause up to 4032 bytes to be written beyond the allocated buffer, leading to memory corruption or process crash.
- CVE-2026-70653Medium
In libvips before version 8.18.3, the old-style Radiance RLE decoder can process a repeat marker at the beginning of a scanline and read q[-1] before any prior pixel exists. This can disclose four bytes of adjacent heap data when loading a crafted Radiance image.
- CVE-2026-70651Medium
In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.
- CVE-2026-69242High
libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.
- CVE-2026-35591High
Vulnerability in libvips up to version 8.18.1. The tiffload operation may incorrectly determine the number of channels in JPEG/JPEG2000 tiles within a TIFF image, leading to a buffer overflow. Fixed in version 8.18.2.
- CVE-2026-35590Medium
libvips versions up to 8.18.1 have a vulnerability in the EXIF decoder. Missing range verification of EXIF tag groups can cause a null pointer dereference and crash. Fixed in version 8.18.2.
- CVE-2026-33328Medium
libvips versions up to 8.18.0 on 32-bit systems have a vulnerability in the gifload operation. Incorrect dimension determination can lead to an integer overflow. Fixed in version 8.18.1.
- CVE-2026-33327High
Vulnerability in libvips up to version 8.18.0. The vipsload operation may incorrectly determine image dimensions, leading to an integer overflow and subsequent heap-based buffer overflow. Fixed in version 8.18.1.
Original NVD description (English source)
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.