Skip to main content

libvips CVE-2026-35591

| EUVDEUVD-2026-46004 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-20 GitHub_M
Buffer Overflow Heap Overflow Libvips
7.0
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.0 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Malicious images commonly reach libvips-backed upload/thumbnail pipelines unauthenticated, so AV:N/PR:N; heap overflow yields high integrity/availability impact but no direct data disclosure, so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 20, 2026 - 17:55 vuln.today
Analysis Generated
Jul 20, 2026 - 17:55 vuln.today
CVE Published
Jul 20, 2026 - 16:24 cve.org
HIGH 7.0

DescriptionCVE.org

libvips is a fast image processing library with low memory needs. The tiffload operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

AnalysisAI

Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF image trigger memory corruption during decode. The flaw stems from libvips incorrectly determining the channel/component count of a JPEG- or JPEG2000-encoded tile embedded in a TIFF, so the pixel buffer is sized from the TIFF photometric metadata while more components are written from the codec. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft TIFF with JPEG/JP2K tile
Delivery
Submit image to libvips tiffload
Exploit
Component count mismatch bypasses sizing
Execution
Overflow heap tile buffer
Impact
Corrupt memory, crash or potential code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target application must process an attacker-supplied TIFF image with libvips ≤ 8.18.1 via the tiffload path, and that TIFF must contain JPEG- or JPEG2000-compressed tiles where the codec's component count differs from the TIFF's photometric_interpretation-derived bytes-per-pixel - that metadata/codec mismatch IS the trigger. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H, base 7.0) rates this a local, low-privilege issue with high integrity and availability impact and only low confidentiality impact - consistent with a memory-corruption bug that is more likely to crash or corrupt state than to leak data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker uploads a specially crafted TIFF file whose tiles are JPEG- or JPEG2000-encoded and whose inner codec reports more color components than the TIFF photometric metadata declares. When a service backed by libvips (e.g. …
Remediation Vendor-released patch: 8.18.2 - upgrade libvips to 8.18.2 or later, which adds the component-count validation for JPEG and JP2K tiles (fix PR https://github.com/libvips/libvips/pull/4973, commit df044e409a0db77c980fa1a9f86a13fbfb2dc8fe). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all applications and systems in your infrastructure using libvips 8.18.1 or earlier, specifically noting which ones process TIFF images. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libvips

View all
CVE-2019-17534 HIGH POC
8.8 Oct 13

vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
CVE-2018-7998 HIGH POC
7.5 Mar 09

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
CVE-2021-27847 MEDIUM POC
6.5 Jul 15

Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
CVE-2026-3145 MEDIUM POC
5.3 Feb 25

Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
CVE-2020-20739 MEDIUM POC
5.3 Nov 20

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
CVE-2026-3283 LOW POC
3.3 Feb 27

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
CVE-2026-3282 LOW POC
3.3 Feb 27

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
CVE-2026-3146 LOW POC
3.3 Feb 25

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
CVE-2026-33327 HIGH
7.0 Jul 20

Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
CVE-2026-35590 MEDIUM
6.8 Jul 20

Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory

CVE-2026-33328 MEDIUM
6.8 Jul 20

Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in
CVE-2026-3281 LOW POC
1.9 Feb 27

Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8
CVE-2023-6246 HIGH POC
8.4
CVE-2026-42945 CRITICAL POC
9.2
CVE-2014-0781 CRITICAL POC
9.3

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-35591 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy