UBUNTU-CVE-2026-35590: Null Pointer Dereference

Published Jul 20, 2026

Updated

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Affected Software

6 affected components

ubuntu/vips*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libvips to a version that resolves this vulnerability.
Fixed in 8.18.2

Event History

Jul 20, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access is required to exploit this issue?

The vulnerability is rated as requiring local access and low privileges. No user interaction is required.

What is the practical impact of successful exploitation?

Successful exploitation can cause a null pointer dereference in EXIF processing, resulting in a crash and loss of availability for the affected process.

Which versions need remediation?

libvips versions through 8.18.1 are affected. The issue is patched in version 8.18.2.

UBUNTU-CVE-2026-35590: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access is required to exploit this issue?

What is the practical impact of successful exploitation?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

What level of access is required to exploit this issue?

What is the practical impact of successful exploitation?

Which versions need remediation?