CVE-2026-35591
Received Received - Intake

Heap-based Buffer Overflow in libvips TIFF Image Processing

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-35591
EUVD
EUVD-2026-46004

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libvips libvips to 8.18.1 (inc)
libvips libvips 8.18.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based buffer overflow in libvips versions 8.18.1 and earlier. It occurs when decoding TIFF images with specially crafted JPEG or JPEG2000-encoded tiles. The tiffload operation incorrectly determines the number of channels in these tiles, leading to memory corruption.

Detection Guidance

To detect this vulnerability, check the installed version of libvips on your system. Run: vips --version. If the version is 8.18.1 or earlier, the system is vulnerable. Additionally, inspect TIFF images processed by libvips for potential corruption or unusual behavior during loading.

Impact Analysis

An attacker could exploit this to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The impact depends on how libvips is used in your environment.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution or denial of service through memory corruption. Exploitation may lead to unauthorized access to sensitive data processed by libvips, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade libvips to version 8.18.2 or later immediately. If upgrading is not possible, block the VipsForeignLoadTiff operation using vips_operation_block_set as a temporary workaround. Avoid processing untrusted TIFF images until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart