CVE-2026-70653

Received Received - Intake

Heap Data Disclosure in libvips Radiance Image Decoder

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanline_read_old and read q[-1] before any prior pixel exists. A crafted Radiance image loaded through VipsForeignLoadRad can therefore disclose four bytes of adjacent heap data, most likely other image data. This issue is fixed in version 8.18.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-70653

Affected Vendors & Products

Vendor	Product	Version / Range
libvips	libvips	to 8.18.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in libvips, an image processing library, before version 8.18.3. It involves a flaw in the old-style Radiance RLE decoder where a repeat marker at the start of a scanline can cause the program to read uninitialized heap memory. This may lead to disclosure of four bytes of adjacent heap data, likely other image data.

Detection Guidance

This vulnerability can be detected by checking the version of libvips installed on your system. If you are running a version prior to 8.18.3, your system is vulnerable. Use the command 'vips --version' or 'dpkg -l | grep libvips' on Debian-based systems to check the installed version.

Impact Analysis

An attacker could exploit this to read sensitive data from memory, such as other image data or potentially confidential information. This could lead to information disclosure or further exploitation depending on the context.

Mitigation Strategies

Immediately update libvips to version 8.18.3 or later. On Debian-based systems, use 'sudo apt-get update && sudo apt-get install --only-upgrade libvips'. For other systems, download the latest version from the official libvips website or use your package manager to upgrade.

Hi! I’m here to help you understand CVE-2026-70653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70