libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8994-1 advisory.

    It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but     not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial     of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-59933)

    It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading     to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in     a denial of service, or possibly execute arbitrary code. (CVE-2026-33327)

    It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit     systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to     crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
    (CVE-2026-33328)

    It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use     this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-35590)

    It was discovered that libvips incorrectly determined the number of channels in certain encoded tiles     within TIFF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591)

    It was discovered that libvips incorrectly validated scanlines in certain TIFF images with many bands,     leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash,     resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code.
    (CVE-2026-69242)

    It was discovered that libvips incorrectly calculated frame heights when loading certain multi-page TIFF     images through ImageMagick. An attacker could possibly use this issue to cause libvips to crash, resulting     in a denial of service. (CVE-2026-70651)

    It was discovered that libvips incorrectly handled certain Radiance images. An attacker could possibly use     this issue to obtain sensitive information. (CVE-2026-70653)

    It was discovered that libvips incorrectly calculated read sizes when processing certain uncompressed PPM     images from custom sources. An attacker could possibly use this issue to cause libvips to crash, resulting     in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70654)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6552 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6552-1                   security@debian.org     https://www.debian.org/security/                              Tianyu Chen     October 11, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : vips     CVE ID         : CVE-2025-59933 CVE-2026-33327 CVE-2026-33328 CVE-2026-35590                      CVE-2026-35591 CVE-2026-69242 CVE-2026-70651 CVE-2026-70653                      CVE-2026-70654

    Several vulnerabilities have been discovered in vips, a fast image     processing library. These vulnerabilities could result in denial of service,     memory safety issues, or other security impact when processing specially     crafted image files or data.

    For the stable distribution (trixie), these problems have been fixed in     version 8.16.1-1+deb13u2.

    We recommend that you upgrade your vips packages.

    For the detailed security status of vips please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/vips

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions     before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow     and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1. (CVE-2026-33327)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376411	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libvips vulnerabilities (USN-8994-1)	Nessus	Ubuntu Local Security Checks	Local	high
367973	Debian dsa-6552 : gir1.2-vips-8.0 - security update	Nessus	Debian Local Security Checks	Local	high
328341	Linux Distros Unpatched Vulnerability : CVE-2026-33327	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-33327

high

Tenable Plugins

high

high

high