EUVD-2026-46001Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege required because exploitation depends on a 32-bit build and ability to supply crafted GIF input; only availability is impacted.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.
AnalysisAI
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause incorrect buffer sizing and crash the image-processing application. Affected are all libvips builds up to and including 8.18.0 compiled for 32-bit architectures, where multiplying GIF width by height as a native int can wrap past INT_MAX. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation strictly requires a 32-bit build of libvips version 8.18.0 or earlier - on 64-bit systems, int arithmetic does not overflow at GIF-scale dimensions and the vulnerability cannot be triggered. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) indicates a local, low-privilege attack with no confidentiality or integrity impact and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to supply a crafted GIF file to an application using libvips on a 32-bit system constructs an image with extreme width and height values whose product exceeds INT_MAX/4. When gifload processes the file, the unguarded integer multiplication wraps around, causing the library to calculate an incorrect buffer size, which leads to a crash and denial of service of the image-processing process. |
| Remediation | Upgrade to libvips 8.18.1, which resolves the overflow via commit 9b633e45abfcf1fc4c84847007c81805193c0969 (PR #4935). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory
Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today