Junglewise Threat Intelligence

CVE-2026-33328: libvips integer overflow in gifload on 32-bit systems

CVE-2026-33328 · Severity: info · CVSS 6.8 · Published 2026-07-20

Technologies: Libvips. Vendors: Libvips.

Executive brief

libvips is a high-speed image processing library used by many applications to handle and resize images. On 32-bit systems, a flaw in how the library processes GIF files could allow an attacker to cause a system crash or service outage. This could disrupt operations for any software relying on this library to process user-uploaded images.

Technical details

An integer overflow vulnerability (CWE-190) exists in libvips within the `gifload` operation (specifically in `nsgifload.c`). The flaw occurs on 32-bit platforms when the library incorrectly calculates image dimensions, potentially leading to memory corruption or a denial-of-service (DoS) condition. An attacker with local access or the ability to submit a malicious GIF for processing could trigger this overflow. The issue is specific to 32-bit architectures where address space and integer sizes are more constrained. The vulnerability has been addressed in version 8.18.1, and a workaround exists to block the `VipsForeignLoadNsgif` operation.

Affected products

  • libvips libvips <= 8.18.0

Timeline

  • 2026-03-07: patched: Fix merged into 8.18 branch via pull request 4935
  • 2026-07-17: advisory: GitHub Security Advisory published
  • 2026-07-20: disclosed: CVE published to NVD

References

Related threats