PT-2026-33455 · Libvips · Libvips

Biniam · Published 2026-04-17 · Updated 2026-04-20 · CVE-2026-6491

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.19

Description A heap-based buffer overflow exists in the nip2 Handler component within the im minpos vec() function of the file libvips/deprecated/vips7compat.c. This issue occurs when the argument n is manipulated, allowing for a memory corruption. Exploitation requires local access.

Recommendations Update to version 8.19 or later to remove the deprecated area containing the vulnerable function.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

CVE-2026-6491

Affected Products

Libvips

References · 15

• 🔥 https://github.com/biniamf/pocs/tree/main/libvips_im_minpos_vec_oob · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6491 · Security Note
• https://ubuntu.com/security/CVE-2026-6491 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6491 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-6491 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6491 · Security Note
• https://github.com/libvips/libvips/issues/4965 · Note
• https://github.com/libvips/libvips/issues/4965#issuecomment-4135003499 · Note
• https://github.com/libvips/libvips · Note
• https://twitter.com/CVEnew/status/2045889738691719270 · Twitter Post
• https://vuldb.com/vuln/358035/cti · Note
• https://vuldb.com/submit/786994 · Note
• https://vuldb.com/vuln/358035 · Note
• https://twitter.com/VulmonFeeds/status/2045206826849812830 · Twitter Post