Log in Start free

Vulnerability · Published Apr 17, 2026 · Assigned by VulDB

CVE-2026-6491libvips nip2 vips7compat.c im_minpos_vec heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in libvips. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 94.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vipsno fix listedDEBIAN-CVE-2026-6491
Debian:13vipsno fix listedDEBIAN-CVE-2026-6491
Debian:14vipsno fix listedDEBIAN-CVE-2026-6491
Ubuntu:25.10vipsno fix listedUBUNTU-CVE-2026-6491
Ubuntu:26.10vipsno fix listedUBUNTU-CVE-2026-6491

Affected products (as reported)

VendorProductVersions
n/a libvips 8.18.08.18.18.18.2

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:T/RC:C

References