EUVD-2026-46002Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges align with PR:L in CVSS 4.0; pure availability crash with no confidentiality or integrity impact supports C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
AnalysisAI
Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory (IFD) index values before passing them to libexif, enabling a crash via null pointer dereference when a crafted image with an out-of-range IFD tag group index is processed. All platforms running libvips through its EXIF parsing path are affected, including downstream consumers such as Node.js sharp and other language bindings that link against libvips. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running libvips 8.18.1 or earlier and must process a user-supplied or attacker-controlled image file that passes through the EXIF decoder (i.e., a format that libvips parses EXIF metadata from, such as JPEG or TIFF). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) scores this at 6.8, modeling it as a local, low-privilege, low-complexity crash with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to an image upload endpoint backed by a libvips 8.18.1 or earlier deployment submits a crafted JPEG or TIFF containing an EXIF IFD index value outside the valid range recognized by libexif. When the application processes the upload through libvips's EXIF decoder, the unvalidated IFD index is passed directly to libexif's array lookup, triggering a null pointer dereference that crashes the libvips worker process and causes a denial of service. … |
| Remediation | Upgrade libvips to version 8.18.2, which contains the bounds check fix for the IFD range validation (commit 91ebd4d35341a8353ea490392d556d582e4b846f; advisory GHSA-jmwm-wc68-mhwm at https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima
Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo
Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in
Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today