CVE-2026-69242: libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vipsimagesanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libvipsto a version that resolves this vulnerability.Fixed in 8.18.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libvips versions before 8.18.3 are exposed when they process attacker-crafted many-band TIFF files through VipsForeignLoadTiff.
What could exploitation allow?
The flaw can cause reads or writes involving other image data through attacker-controlled negative offsets in mmap-resident allocations. It may disclose data through uncompressed .v output and is likely to crash the affected process; remote code execution has not been demonstrated but cannot be ruled out.
How can I remediate the issue?
Upgrade libvips to version 8.18.3, which fixes the vulnerability.