Read the docs
TI-2026-49354 Aliases CVE-2026-70652

libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

Priority LOW 10CWE-126Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Fixed libvips (libvips): 8.18.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libvipslibvipsbefore 8.18.38.18.3Patch availableCNA
  • libvips Vendorlibvips Affected before 8.18.3 Fixed in 8.18.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*——libvips
  • cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:* Versions — — ·libvips

Remediation

  • Fix · CNA libvips (libvips) Fixed in 8.18.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70652

References

Other 4

  • TI-2026-02835 libvips extract.c vips_extract_area_build integer overflow CVSS 4.0MEDIUM 4.8
  • TI-2026-02834 libvips extract.c vips_extract_band_build out-of-bounds CVSS 4.0MEDIUM 4.8
  • TI-2026-02833 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds CVSS 4.0MEDIUM 4.8
  • TI-2026-02832 libvips bandrank.c vips_bandrank_build heap-based overflow CVSS 4.0MEDIUM 4.8
  • TI-2026-02719 libvips csvload.c vips_foreign_load_csv_build heap-based overflow CVSS 4.0MEDIUM 4.8
  • TI-2026-02718 libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference CVSS 4.0MEDIUM 4.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences