CVE-2026-35590

EUVD-2026-46002
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.19%
Affected Products (NVD)
VendorProductVersion
libvipslibvips
𝑥
< 8.18.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vips
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
8.18.5-1
fixed
sid
8.18.6-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f
https://github.com/libvips/libvips/pull/4972
https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm