CVE-2026-35590
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Jul 20, 2026
CISA due date
—
The record
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112403 Pillow is a Python imaging library. CWE-122
- CVE-2026-112393 Pillow is a Python imaging library. CWE-122
- CVE-2026-112395 Pillow is a Python imaging library. CWE-122
- CVE-2026-103658 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer… CWE-122
- CVE-2026-107161 A heap-based buffer overflow flaw was found in Cyrus SASL. CWE-122
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-122
- CVE-2026-106564 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-122
- CVE-2026-46570 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in… CWE-122