EUVD-2026-46002Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges align with PR:L in CVSS 4.0; pure availability crash with no confidentiality or integrity impact supports C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
AnalysisAI
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory (IFD) index values before passing them to libexif, enabling a crash via null pointer dereference when a crafted image with an out-of-range IFD tag group index is processed. All platforms running libvips through its EXIF parsing path are affected, including downstream consumers such as Node.js sharp and other language bindings that link against libvips. No public exploit has been identified and active exploitation is not confirmed, but the fix is publicly visible and the crash condition is straightforward to reproduce.
Technical ContextAI
libvips (CPE: cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*) is a C image processing library that delegates EXIF metadata parsing to libexif. EXIF metadata is organized into Image File Directories (IFDs), each addressed by an integer index. The vulnerable function vips_exif_image_field in libvips/foreign/exif.c used the caller-supplied IFD index directly as an array subscript without checking whether it fell within the valid range [0, EXIF_IFD_COUNT). A crafted EXIF payload embedding an out-of-range IFD index therefore passed an invalid value into libexif's IFD array lookup, triggering a null pointer dereference (crash). The reporter classifies this as CWE-122 (Heap-based Buffer Overflow) and tags it as both a heap overflow and DoS; the CVE description characterizes the outcome as a null pointer dereference. The discrepancy likely reflects that the out-of-bounds index can result in either a heap read past the IFD array boundary or a null dereference depending on libexif's internal layout - both outcomes terminate the process. The fix, introduced in commit 91ebd4d, adds a two-line guard: if (ifd < 0 || ifd >= EXIF_IFD_COUNT) { return NULL; } immediately before the array access.
RemediationAI
Upgrade libvips to version 8.18.2, which contains the bounds check fix for the IFD range validation (commit 91ebd4d35341a8353ea490392d556d582e4b846f; advisory GHSA-jmwm-wc68-mhwm at https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm). Downstream consumers such as Node.js sharp should upgrade to a release that bundles libvips 8.18.2 or later. For deployments that cannot upgrade immediately, stripping EXIF metadata from all untrusted image inputs before they reach libvips is an effective compensating control - tools such as ExifTool (exiftool -all= input.jpg) or ImageMagick (convert -strip input.jpg output.jpg) can sanitize inputs at an ingestion layer; the trade-off is added processing latency and loss of legitimate EXIF data (GPS, camera model, orientation) that downstream applications may depend on. Restricting the set of image sources to trusted, internally-generated files eliminates the attack surface entirely where feasible.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in
Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today