UBUNTU-CVE-2026-33328: Integer Overflow

Published Jul 20, 2026

Updated

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.

Affected Software

2 affected components

ubuntu/vips*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libvips to a version that resolves this vulnerability.
Fixed in 8.18.1

Event History

Jul 20, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

The issue affects libvips on 32-bit systems when using the gifload operation in versions 8.18.0 and earlier. The provided data does not indicate that 64-bit systems are affected.

What access does an attacker need to exploit this?

The vector is local and requires low privileges, with no user interaction required. Exploitation involves triggering gifload processing with dimensions that cause an integer overflow.

What is the remediation?

Upgrade libvips to version 8.18.1 or later, which includes the patch.

UBUNTU-CVE-2026-33328: Integer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this?

What is the remediation?