CVE-2026-88360: Libvips libvips vulnerability
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vipsavgscan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to be affected by this issue?
Systems using libvips 8.19.0 to process little-endian PFM images are exposed. The failure is most likely on strict-alignment architectures or in builds instrumented with UBSan, where the unaligned float access can terminate the process.
What must an attacker provide to trigger the denial of service?
An attacker needs to cause the application to process a little-endian PFM image whose text header length is not a multiple of four bytes. The malformed header causes the mmap-based loader to expose pixel data at an address not properly aligned for float access.
How can I determine whether an application is affected?
Check whether the application uses libvips 8.19.0 and accepts or processes PFM images, particularly from untrusted sources. Affected environments may terminate while averaging or scanning a crafted little-endian PFM image, and UBSan-instrumented builds may report an alignment-related undefined-behavior error.