CVE-2026-35590

EUVD-2026-46002
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
6.8 MEDIUM
LOCAL
LOW
LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
libvipslibvips
𝑥
≤ 8.18.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
vips
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
8.18.4-1
fixed
sid
8.18.4-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f
https://github.com/libvips/libvips/pull/4972
https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm