PT-2026-61635 · Libvips · Libvips

CVE-2026-35590 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.2

Description The EXIF decoder fails to verify the range of EXIF tag groups before passing data to libexif. This lack of validation can lead to a null pointer dereference, which is a condition where the software attempts to read from a memory address that is null, resulting in a crash.

Recommendations Update to version 8.18.2.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-35590

GHSA-JMWM-WC68-MHWM

Affected Products

Libvips

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35590.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-35590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35590 · Security Note
• https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm · Note
• https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f · Note
• https://github.com/libvips/libvips/pull/4972 · Note