Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-70653libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image

Medium 4.8

In plain English

A medium-severity heap buffer overflow in libvips from libvips. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.1%top 97.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanline_read_old and read q[-1] before any prior pixel exists. A crafted Radiance image loaded through VipsForeignLoadRad can therefore disclose four bytes of adjacent heap data, most likely other image data. This issue is fixed in version 8.18.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	vips	no fix listed	DEBIAN-CVE-2026-70653
Debian:13	vips	8.16.1-1+deb13u2	DEBIAN-CVE-2026-70653
Debian:14	vips	8.18.3-1	DEBIAN-CVE-2026-70653

Affected products (as reported)

Vendor	Product	Versions
libvips	libvips	< 8.18.3

Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/libvips/libvips/security/advisories/GHSA-fh99-55jf-5hj3 x_refsource_CONFIRM
https://github.com/libvips/libvips/pull/5037 x_refsource_MISC
https://github.com/libvips/libvips/commit/dc945573e15d598054e701c65b90a35b16b19304 x_refsource_MISC
https://github.com/libvips/libvips/releases/tag/v8.18.3 x_refsource_MISC