CVE-2026-6491
Heap-Based Buffer Overflow in libvips nip2 Handler (im_minpos_vec
Publication date: 2026-04-17
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libvips | libvips | to 8.18.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the libvips library up to version 8.18.2, specifically in the function im_minpos_vec within the file libvips/deprecated/vips7compat.c of the nip2 Handler component. It involves manipulation of the argument 'n' which leads to a heap-based buffer overflow. This means that an attacker who has local access to the system can exploit this flaw to cause memory corruption.
How can this vulnerability impact me? :
The vulnerability can lead to a heap-based buffer overflow, which may allow an attacker with local access to execute arbitrary code, cause a crash, or corrupt memory. This can compromise the stability and security of the affected system or application using libvips.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability affects libvips up to version 8.18.2 in the deprecated function im_minpos_vec. Since the vendor plans to remove the deprecated area in libvips 8.19, an immediate mitigation step is to upgrade libvips to version 8.19 or later once available.
Additionally, because the attack requires local access, restricting local user permissions and limiting access to systems running vulnerable versions of libvips can help reduce risk.