Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-35591

libvips is a fast image processing library with low memory needs

Risk score
52/100
CVSS
7.8 v3.1
Published
20 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
libvips is a fast image processing library with low memory needs. The tiffload operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.1…
Affected
Libvips before 8.18.2
Fix
Upgrade Libvips to 8.18.2 or later.
Exploitation
No known exploitation

Story map

Story map: LibvipsTHE FLAWSTHE FIXCVE-2026-35591Libvips is a fast imageprocessing library with lowmemory needsCVSS 7.8CVE-2025-59933Libvips is a demand-driven,horizontally threaded imageprocessing libraryCVSS 7.8CVE-2026-33327Libvips is a fast imageprocessing library with lowmemory needsCVSS 7.8Upgrade Libvips8.18.2 · 8.17.2 · 8.18.1or later on your release lineWho is exposedLibvips before 8.18.2YELLOW · PLAN IT INLibvipslibvips is a fast imageprocessing library with lowmemory needs. The tiffloadoperation in libvips versionsbefore and including 8.18.1 couldincorrectly determine thenumber of channels in a JPEG…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.3 Nov · Ubuntu security noticesUSN-8994-1: libvips vulnerabilitiesCONNECTS TOSame weaknessHeap buffer overflow (CWE-122)399 other warnings in 30 days →Same productEarlier Libvips warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Libvips: Yellow, plan it in. libvips is a fast image processing library with low memory needs. The tiffload operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.1…

The flaws

  • CVE-2026-35591: Libvips is a fast image processing library with low memory needs (CVSS 7.8)
  • CVE-2025-59933: Libvips is a demand-driven, horizontally threaded image processing library (CVSS 7.8)
  • CVE-2026-33327: Libvips is a fast image processing library with low memory needs (CVSS 7.8)

The fix

Upgrade Libvips: 8.18.2 · 8.17.2 · 8.18.1 or later on your release line

Who is exposed: Libvips before 8.18.2

Where it stands

  • No known exploitation

How it unfolded

  1. 3 Nov, Ubuntu security notices (official): USN-8994-1: libvips vulnerabilities

Connects to

Why it is Yellow

  • CVSS 7.8 high
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

Last activity 3 Nov 2026. Patch Forecast updates every hour.