Heap-Based Buffer Overflow in libvips Image Processing Library
CVE-2026-33327

7HIGH

Key Information:

Vendor

Libvips

Status
Libvips
Vendor
CVE Published:
20 July 2026

What is CVE-2026-33327?

libvips, a rapid image processing library designed for efficiency and low memory usage, has a vulnerability in its vipsload operation. Versions up to and including 8.18.0 may mishandle the determination of image dimensions, leading to an integer overflow which can result in a heap-based buffer overflow. This issue has been addressed in version 8.18.1, which users are strongly encouraged to update to in order to safeguard against potential exploitation.

Affected Version(s)

libvips <= 8.18.0

References

https://github.com/libvips/libvips/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/libvips/libvips/pull/4934
x_refsource_MISC
https://github.com/libvips/libvips/commit/61e71c13328ed72...
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.