Executive brief
libvips is a high-performance image processing library used by many applications to handle large image files. A vulnerability in how it processes TIFF images could allow an attacker to cause a system crash or potentially execute unauthorized commands. This occurs when the library handles specially crafted image tiles, which could disrupt services or compromise the security of the server processing the images.
Technical details
A heap-based buffer overflow (CWE-122) exists in the libvips library within the `tiffload` operation. The vulnerability is caused by the library incorrectly calculating the number of channels in JPEG or JPEG2000-encoded tiles embedded within a TIFF image. An attacker with local access could provide a maliciously crafted TIFF file to trigger the overflow. This can result in a denial of service (crash) or potentially arbitrary code execution. The issue is fixed in version 8.18.2 by validating that the number of components in the tile matches the photometric interpretation.
Affected products
- libvips libvips <= 8.18.1
Timeline
- 2026-03-26: patched: Fix merged into 8.18 branch
- 2026-07-17: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD