CVE-2026-33327CWE-190

CVE-2026-33327

High · published July 20, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-07-20T21:17Z
Affected products (1)
ProductVersionsFixed in
libvips/libvips< 8.18.18.18.1
References (3)
https://github.com/libvips/libvips/commit/61e71c13328ed72d0a530dffc19b9b225072bdf9 · [email protected]https://github.com/libvips/libvips/pull/4934 · [email protected]https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x · [email protected]
EPSS history
Timeline
  • 20 JUL 16:21Z
    Possible integer overflow leading to potential heap-based buffer overflow
    cvelistv5