Executive brief
libvips is a high-speed image processing library used by many applications to handle and resize images. On 32-bit systems, a flaw in how the library processes GIF files could allow an attacker to cause a system crash or service outage. This could disrupt operations for any software relying on this library to process user-uploaded images.
Technical details
An integer overflow vulnerability (CWE-190) exists in libvips within the `gifload` operation (specifically in `nsgifload.c`). The flaw occurs on 32-bit platforms when the library incorrectly calculates image dimensions, potentially leading to memory corruption or a denial-of-service (DoS) condition. An attacker with local access or the ability to submit a malicious GIF for processing could trigger this overflow. The issue is specific to 32-bit architectures where address space and integer sizes are more constrained. The vulnerability has been addressed in version 8.18.1, and a workaround exists to block the `VipsForeignLoadNsgif` operation.
Affected products
- libvips libvips <= 8.18.0
Timeline
- 2026-03-07: patched: Fix merged into 8.18 branch via pull request 4935
- 2026-07-17: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD