CVE-2026-33327

Katalog CVE

CVSS 7.8 · High EPSS 0,17%

Kerentanan Integer Overflow or Wraparound pada libvips. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

19 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x advisory vendor · mitigasi
• https://github.com/libvips/libvips/commit/61e71c13328ed72d0a530dffc19b9b225072bdf9 patch
• https://github.com/libvips/libvips/pull/4934 issue tracking · patch