CVE-2026-88360
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service.
Risk Assessment
An attacker can cause a crash of the image processing process, potentially leading to service disruption and unavailability of the application.
Recommendation
Update libvips to the latest version that includes a fix for this vulnerability. If not possible, avoid processing untrusted PFM files or apply a workaround to enforce data alignment.
Other vulnerabilities in libvips
See all- CVE-2026-70654Medium
In libvips before version 8.18.3, applications using custom sources and processing untrusted PPM images can trigger a max/min error in vips_source_read_to_memory. Using VIPS_MAX instead of VIPS_MIN when selecting the read size can cause up to 4032 bytes to be written beyond the allocated buffer, leading to memory corruption or process crash.
- CVE-2026-70653Medium
In libvips before version 8.18.3, the old-style Radiance RLE decoder can process a repeat marker at the beginning of a scanline and read q[-1] before any prior pixel exists. This can disclose four bytes of adjacent heap data when loading a crafted Radiance image.
- CVE-2026-70652Low
libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.
- CVE-2026-70651Medium
In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.
- CVE-2026-69242High
libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.
- CVE-2026-35591High
Vulnerability in libvips up to version 8.18.1. The tiffload operation may incorrectly determine the number of channels in JPEG/JPEG2000 tiles within a TIFF image, leading to a buffer overflow. Fixed in version 8.18.2.
- CVE-2026-35590Medium
libvips versions up to 8.18.1 have a vulnerability in the EXIF decoder. Missing range verification of EXIF tag groups can cause a null pointer dereference and crash. Fixed in version 8.18.2.
- CVE-2026-33328Medium
libvips versions up to 8.18.0 on 32-bit systems have a vulnerability in the gifload operation. Incorrect dimension determination can lead to an integer overflow. Fixed in version 8.18.1.
- CVE-2026-33327High
Vulnerability in libvips up to version 8.18.0. The vipsload operation may incorrectly determine image dimensions, leading to an integer overflow and subsequent heap-based buffer overflow. Fixed in version 8.18.1.
Original NVD description (English source)
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS