UBUNTU-CVE-2026-33327: Buffer Overflow

Published Jul 20, 2026

Updated

libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.

Affected Software

6 affected components

ubuntu/vips*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libvips to a version that resolves this vulnerability.
Fixed in 8.18.1

Event History

Jul 20, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need?

The attack vector is local and requires low privileges. No user interaction is required.

What is the likely security impact?

The vulnerability has low confidentiality impact and high integrity and availability impact. The affected security scope does not extend beyond the vulnerable component.

How can I identify systems that may be vulnerable?

Check Ubuntu systems using the vips package. Versions before and including 8.18.0 are affected; version 8.18.1 contains the patch.