Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-35591Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile

High 7.0

In plain English

A high-severity heap buffer overflow in libvips from libvips. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	vips	no fix listed	DEBIAN-CVE-2026-35591
Debian:13	vips	8.16.1-1+deb13u2	DEBIAN-CVE-2026-35591
Debian:14	vips	8.18.2-1	DEBIAN-CVE-2026-35591

Affected products (as reported)

Vendor	Product	Versions
libvips	libvips	<= 8.18.1

Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76 x_refsource_CONFIRM
https://github.com/libvips/libvips/pull/4973 x_refsource_MISC
https://github.com/libvips/libvips/commit/df044e409a0db77c980fa1a9f86a13fbfb2dc8fe x_refsource_MISC