CVE-2026-35590

medium

Description

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

References

https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm

https://github.com/libvips/libvips/pull/4972

https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f

Details

Source: Mitre, NVD

Published: 2026-07-20

Updated: 2026-07-20

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

CVSS v4

Base Score: 6.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: Medium