libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8994-1 advisory.

    It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but     not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial     of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-59933)

    It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading     to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in     a denial of service, or possibly execute arbitrary code. (CVE-2026-33327)

    It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit     systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to     crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
    (CVE-2026-33328)

    It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use     this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-35590)

    It was discovered that libvips incorrectly determined the number of channels in certain encoded tiles     within TIFF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591)

    It was discovered that libvips incorrectly validated scanlines in certain TIFF images with many bands,     leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash,     resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code.
    (CVE-2026-69242)

    It was discovered that libvips incorrectly calculated frame heights when loading certain multi-page TIFF     images through ImageMagick. An attacker could possibly use this issue to cause libvips to crash, resulting     in a denial of service. (CVE-2026-70651)

    It was discovered that libvips incorrectly handled certain Radiance images. An attacker could possibly use     this issue to obtain sensitive information. (CVE-2026-70653)

    It was discovered that libvips incorrectly calculated read sizes when processing certain uncompressed PPM     images from custom sources. An attacker could possibly use this issue to cause libvips to crash, resulting     in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70654)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6552 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6552-1                   security@debian.org     https://www.debian.org/security/                              Tianyu Chen     October 11, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : vips     CVE ID         : CVE-2025-59933 CVE-2026-33327 CVE-2026-33328 CVE-2026-35590                      CVE-2026-35591 CVE-2026-69242 CVE-2026-70651 CVE-2026-70653                      CVE-2026-70654

    Several vulnerabilities have been discovered in vips, a fast image     processing library. These vulnerabilities could result in denial of service,     memory safety issues, or other security impact when processing specially     crafted image files or data.

    For the stable distribution (trixie), these problems have been fixed in     version 8.16.1-1+deb13u2.

    We recommend that you upgrade your vips packages.

    For the detailed security status of vips please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/vips

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-107641b428 advisory.

    New version of vips.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d9707059b7 advisory.

    New version of vips.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below,     when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a     buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a     height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith     support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected     is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most     language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all     untrusted loaders including PDF input via poppler. (CVE-2025-59933)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376411	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libvips vulnerabilities (USN-8994-1)	Nessus	Ubuntu Local Security Checks	Local	high
367973	Debian dsa-6552 : gir1.2-vips-8.0 - security update	Nessus	Debian Local Security Checks	Local	high
279040	Fedora 42 : vips (2025-107641b428)	Nessus	Fedora Local Security Checks	Local	medium
279037	Fedora 43 : vips (2025-d9707059b7)	Nessus	Fedora Local Security Checks	Local	medium
266347	Linux Distros Unpatched Vulnerability : CVE-2025-59933	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-59933

medium

Tenable Plugins

high

high

medium

medium

medium