Skip to content
OpenAdvisories
High USN-8994-1 9 CVEs

vips vulnerabilities

Published Nov 3, 2026 · Updated Nov 4, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libvips incorrectly handled certain PDF files with a
page that defines a width but not a height. An attacker could possibly use
this issue to cause libvips to crash, resulting in a denial of service, or
obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2025-59933)

It was discovered that libvips incorrectly determined image dimensions in
the vipsload operation, leading to an integer overflow. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33327)

It was discovered that libvips incorrectly determined image dimensions in
the gifload operation on 32-bit systems, leading to an integer overflow. An
attacker could possibly use this issue to cause libvips to crash, resulting
in a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-33328)

It was discovered that libvips did not properly validate EXIF tag groups.
An attacker could possibly use this issue to cause libvips to crash,
resulting in a denial of service. (CVE-2026-35590)

It was discovered that libvips incorrectly determined the number of
channels in certain encoded tiles within TIFF images. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591)

It was discovered that libvips incorrectly validated scanlines in certain
TIFF images with many bands, leading to an integer overflow. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service, obtain sensitive information, or possibly execute
arbitrary code. (CVE-2026-69242)

It was discovered that libvips incorrectly calculated frame heights when
loading certain multi-page TIFF images through ImageMagick. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service. (CVE-2026-70651)

It was discovered that libvips incorrectly handled certain Radiance images.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-70653)

It was discovered that libvips incorrectly calculated read sizes when
processing certain uncompressed PPM images from custom sources. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu
26.04 LTS. (CVE-2026-70654)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS vips 8.2.2-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS vips 8.4.5-1ubuntu0.1~esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS vips 8.9.1-2ubuntu0.1~esm2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS vips 8.12.1-1ubuntu0.1~esm3
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS vips 8.15.1-1.1ubuntu0.1~esm2
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS vips 8.18.0-1ubuntu0.1~esm2

Vulnerabilities 9

  • High 8.4
    CVE-2026-69242

    libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write

    libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sani…

    libvips libvips vips vips Debian Ubuntu
  • High 7.0
    CVE-2026-33327

    Possible integer overflow leading to potential heap-based buffer overflow

    libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This ha…

    libvips libvips vips vips Debian Ubuntu Wolfi
  • High 7.0
    CVE-2026-35591

    Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile

    libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a …

    libvips libvips vips vips Debian Ubuntu Wolfi
  • Medium 6.9
    CVE-2026-70651

    libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick

    libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoa…

    libvips libvips vips vips Debian Ubuntu
  • Medium 6.8
    CVE-2026-33328

    Possible integer overflow on 32-bit systems when reading GIF images

    libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.

    libvips libvips vips vips Debian Ubuntu Wolfi
  • Medium 6.8
    CVE-2026-35590

    Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

    libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereferenc…

    libvips libvips vips vips Debian Ubuntu Wolfi
  • Medium 5.8
    CVE-2026-70654

    libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow

    libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_mem…

    libvips libvips vips vips Debian Ubuntu
  • Medium 5.1
    CVE-2025-59933

    libvips is vulnerable to Buffer Over-Read in poppler-based pdfload

    libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of …

    libvips libvips vips vips Debian Ubuntu
  • Medium 4.8
    CVE-2026-70653

    libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image

    libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanline_read_old and read q[-1] before a…

    libvips libvips vips vips Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-59933
  • report
    https://ubuntu.com/security/CVE-2026-33327
  • report
    https://ubuntu.com/security/CVE-2026-33328
  • report
    https://ubuntu.com/security/CVE-2026-35590
  • report
    https://ubuntu.com/security/CVE-2026-35591
  • report
    https://ubuntu.com/security/CVE-2026-69242
  • report
    https://ubuntu.com/security/CVE-2026-70651
  • report
    https://ubuntu.com/security/CVE-2026-70653
  • report
    https://ubuntu.com/security/CVE-2026-70654