EUVD-2026-46001Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege required because exploitation depends on a 32-bit build and ability to supply crafted GIF input; only availability is impacted.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.
AnalysisAI
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause incorrect buffer sizing and crash the image-processing application. Affected are all libvips builds up to and including 8.18.0 compiled for 32-bit architectures, where multiplying GIF width by height as a native int can wrap past INT_MAX. No public exploit is identified at time of analysis; a vendor-released patch is available in libvips 8.18.1.
Technical ContextAI
libvips (CPE: cpe:2.3:a:libvips:libvips) is a C image-processing library commonly embedded in web and desktop applications. The flaw resides in libvips/foreign/nsgifload.c, which uses the nsgif backend to decode GIF files. The root cause is CWE-190 (Integer Overflow or Wraparound): on 32-bit systems where int is 32 bits wide, computing width * height as a native int overflows when the product exceeds INT_MAX (2,147,483,647). The original bounds check also used width > 65536 instead of > 65535, slightly widening the accepted range beyond the GIF specification's maximum dimension. The fix in PR #4935 corrects both issues: it tightens the dimension limit to 65535 and adds a pixel-count guard cast to 64-bit arithmetic - (guint64) width * height > INT_MAX / 4 - before any buffer allocation, mirroring a constraint already present in the gifsave path.
RemediationAI
Upgrade to libvips 8.18.1, which resolves the overflow via commit 9b633e45abfcf1fc4c84847007c81805193c0969 (PR #4935). The fix is confirmed upstream and documented in the ChangeLog entry 'gifload: prevent int overflow on 32-bit platforms'. If an immediate upgrade is not feasible on a 32-bit deployment, restrict the application so that GIF input to the gifload operation is sourced only from trusted, validated files - this prevents an attacker from supplying crafted dimension values. Alternatively, disable GIF loading at the application level entirely; note this will break all GIF-handling functionality. The full advisory is at https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory
Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today