CVE-2026-35590: Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libvipsto a version that resolves this vulnerability.Fixed in 8.18.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35590?
The severity of CVE-2026-35590 is rated as risk 22, indicating a significant impact.
How do I fix CVE-2026-35590?
To fix CVE-2026-35590, update libvips to version 8.18.2 or later, where the vulnerability is patched.
What causes CVE-2026-35590?
CVE-2026-35590 is caused by the EXIF decoder in libvips not verifying the range of EXIF tag groups, leading to potential null pointer dereferences.
Which versions of libvips are affected by CVE-2026-35590?
CVE-2026-35590 affects libvips versions before and including 8.18.1.
What consequences can result from exploiting CVE-2026-35590?
Exploiting CVE-2026-35590 can lead to a crash of the application due to a null pointer dereference.