CVE-2026-35590CWE-122

CVE-2026-35590

Medium · published July 20, 2026

CVSS v3.1

5.5

EPSS

Percentile

3.5

In the wild

Unconfirmed

What it is

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

The record

Technical detail

CVSS v3.1: 5.5 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00146 · 3.5th percentile
Weakness: CWE-122 · Heap-based Buffer Overflow
Published: 2026-07-20T21:17Z

Affected products (1)

Product	Versions	Fixed in
libvips/libvips	< 8.18.2	8.18.2

References (3)

https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f · [email protected]https://github.com/libvips/libvips/pull/4972 · [email protected]https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm · [email protected]

EPSS history

Timeline

20 JUL 16:23Z
Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
cvelistv5