Heap-based buffer overflow in libvips TIFF image decoding (CVE-2026-35591)

The `tiffload` operation in libvips could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible heap-based buffer overflow. An attacker able to supply a crafted TIFF file could trigger this condition, with potential impact to integrity and availability of the affected system. Affected versions: - <=8.18.1 We recommend updating to: >=8.18.2. CVSS 7.0 · our assessment: this_week Reference: https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76 Details: https://vuln.today/cve/CVE-2026-35591