UBUNTU-CVE-2026-35591: Buffer Overflow

Published Jul 20, 2026

Updated

libvips is a fast image processing library with low memory needs. The tiffload operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

Affected Software

3 affected components

ubuntu/vips*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libvips to a version that resolves this vulnerability.
Fixed in 8.18.2

Event History

Jul 20, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using libvips through version 8.18.1 that process TIFF images containing JPEG- or JPEG2000-encoded tiles are exposed. Exploitation requires local access and low privileges, according to the provided vector.

What does an attacker need to do to exploit it?

An attacker needs to cause the vulnerable tiffload operation to process a crafted TIFF image with a JPEG or JPEG2000 tile whose channel count is incorrectly determined. No user interaction is required.

Is there a fix available?

Yes. The issue is patched in libvips version 8.18.2.

UBUNTU-CVE-2026-35591: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is there a fix available?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is there a fix available?