CVE-2026-35591

Katalog CVE

CVSS 7.8 · High EPSS 0,17%

Kerentanan Heap-based Buffer Overflow pada libvips. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

19 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76 advisory vendor · patch
• https://github.com/libvips/libvips/commit/df044e409a0db77c980fa1a9f86a13fbfb2dc8fe patch
• https://github.com/libvips/libvips/pull/4973 issue tracking · patch