CVE-2026-70651

Received Received - Intake

Heap Buffer Over-Read in libvips via Malformed TIFF

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-70651

Affected Vendors & Products

Vendor	Product	Version / Range
libvips	libvips	to 8.18.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-680	The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Attack-Flow Graph

Executive Summary

This vulnerability exists in libvips, an image processing library, prior to version 8.18.3. When libvips is built without libtiff support but with ImageMagick support, it can overflow the combined frame height while loading a crafted multi-page TIFF file. The issue occurs in the calculation that multiplies the per-page Ysize by the number of frames without proper bounds checking, leading to a heap buffer over-read and potential process crash.

Detection Guidance

Detection requires checking if your libvips version is below 8.18.3 and if it was built with ImageMagick support but without libtiff. Run 'vips --version' to check the version. If using a package manager, check installed packages for libvips and ImageMagick. No direct commands detect the overflow itself.

Impact Analysis

This vulnerability could cause an application using the affected libvips version to crash when processing a specially crafted TIFF file. This may lead to denial of service or unexpected termination of the application. However, most package-manager builds include libtiff and do not use the vulnerable fallback path, reducing exposure.

Mitigation Strategies

Upgrade libvips to version 8.18.3 or later. If using a package manager, run the appropriate update command (e.g., 'apt upgrade libvips' or 'yum update libvips'). Verify the update with 'vips --version'.

Hi! I’m here to help you understand CVE-2026-70651. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70