EUVD-2026-63651Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because attacker must supply a file to the local processing pipeline; PR:L for low-privilege file submission; C:L for partial data disclosure; I:H and A:H for memory corruption and reliable crashes.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3.
AnalysisAI
Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a crafted many-band TIFF file reaches the VipsForeignLoadTiff code path in libvips. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 reflects AV:L/AC:L/PR:L, meaning the attack is local with low complexity and low privilege - in practice, this describes any application context where a low-privileged user can supply a TIFF file to a libvips-powered service, such as an image upload endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading libvips to version 8.18.3 or later, available at https://github.com/libvips/libvips/releases/tag/v8.18.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using libvips and identify which services process untrusted TIFF input; block TIFF uploads or disable TIFF format processing where operationally feasible and isolate affected systems from critical business functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today