CVE-2026-35590 | libvips is a fast image processing library with low memory n… | CVSS 6.8 MEDIUM

Description

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Metadata

CVE ID: CVE-2026-35590
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-04-03 20:09 UTC
Published: 2026-07-20 16:23 UTC
Last updated: 2026-07-20 19:03 UTC
Primary CWE: CWE-122
CWE-122: Heap-based Buffer Overflow
Vendor / Product: libvips / libvips
Sources: cve.org · NVD

Severity & Metrics

6.8 MEDIUM CVSS 4.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
libvips	libvips	—	<= 8.18.1

Weakness (CWE)

CWE	Source	Description
CWE-122	cna	CWE-122: Heap-based Buffer Overflow

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.8	MEDIUM	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References (3)

https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm
https://github.com/libvips/libvips/pull/4972 https://github.com/libvips/libvips/pull/4972
https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f