Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-33327

libvips is a fast image processing library with low memory needs

Risk score
52/100
CVSS
7.8 v3.1
Published
20 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.
Affected
Libvips before 8.18.1
Fix
Upgrade Libvips to 8.18.1 or later.
Exploitation
No known exploitation

Story map

Story map: LibvipsTHE FLAWSTHE FIXCVE-2026-33327Libvips is a fast imageprocessing library with lowmemory needsCVSS 7.8CVE-2025-59933Libvips is a demand-driven,horizontally threaded imageprocessing libraryCVSS 7.8CVE-2026-35591Libvips is a fast imageprocessing library with lowmemory needsCVSS 7.8Upgrade Libvips8.18.1 · 8.17.2 · 8.18.2or later on your release lineWho is exposedLibvips before 8.18.1YELLOW · PLAN IT INLibvipslibvips is a fast imageprocessing library with lowmemory needs. The vipsloadoperation in versions before andincluding 8.18.0 could incorrectlydetermine image dimensionsleading to an integer overflow…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.3 Nov · Ubuntu security noticesUSN-8994-1: libvips vulnerabilitiesCONNECTS TOSame weaknessInteger overflow (CWE-190)166 other warnings in 30 days →Same productEarlier Libvips warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Libvips: Yellow, plan it in. libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.

The flaws

  • CVE-2026-33327: Libvips is a fast image processing library with low memory needs (CVSS 7.8)
  • CVE-2025-59933: Libvips is a demand-driven, horizontally threaded image processing library (CVSS 7.8)
  • CVE-2026-35591: Libvips is a fast image processing library with low memory needs (CVSS 7.8)

The fix

Upgrade Libvips: 8.18.1 · 8.17.2 · 8.18.2 or later on your release line

Who is exposed: Libvips before 8.18.1

Where it stands

  • No known exploitation

How it unfolded

  1. 3 Nov, Ubuntu security notices (official): USN-8994-1: libvips vulnerabilities

Connects to

Why it is Yellow

  • CVSS 7.8 high
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.

Last activity 3 Nov 2026. Patch Forecast updates every hour.