Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-35590Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

Medium 6.8

In plain English

A medium-severity heap buffer overflow in libvips from libvips. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.8Medium

Exploit odds (30 days)0.1%top 96.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	vips	no fix listed	DEBIAN-CVE-2026-35590
Debian:13	vips	8.16.1-1+deb13u2	DEBIAN-CVE-2026-35590
Debian:14	vips	8.18.2-1	DEBIAN-CVE-2026-35590

Affected products (as reported)

Vendor	Product	Versions
libvips	libvips	<= 8.18.1

Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm x_refsource_CONFIRM
https://github.com/libvips/libvips/pull/4972 x_refsource_MISC
https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f x_refsource_MISC