Libvips vulnerabilities
We track 10 vulnerabilities in Libvips products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Libvips vulnerabilities
- 8.4 High severity
libvips: Heap-based Buffer Overflow
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanit
- 7.8 High severity
libvips: Heap-based Buffer Overflow
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a p
- 7.8 High severity
libvips: Integer Overflow or Wraparound
libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has
- 7.1 High severity
libvips: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed loca
- 7.1 High severity
libvips: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be
- 7.8 High severity
libvips: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a
- 7.8 High severity
libvips: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been m
- 7.8 High severity
libvips: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack
- 7.0 High severity
libvips: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local
- 7.8 High severity
libvips: Buffer Over-read
libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a