Integer Overflow Vulnerability in libvips Image Processing Library
CVE-2026-33328

6.8MEDIUM

Key Information:

Vendor

Libvips

Status
Libvips
Vendor
CVE Published:
20 July 2026

What is CVE-2026-33328?

libvips, a widely used image processing library, is susceptible to an integer overflow vulnerability during the gifload operation on 32-bit systems. This flaw arises from incorrect dimension determination, leading to potential miscalculation of memory allocation and could allow for unexpected behavior or denial of service. Fortunately, this vulnerability has been addressed in version 8.18.1, ensuring enhanced security for users.

Affected Version(s)

libvips <= 8.18.0

References

https://github.com/libvips/libvips/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/libvips/libvips/pull/4935
x_refsource_MISC
https://github.com/libvips/libvips/commit/9b633e45abfcf1f...
x_refsource_MISC

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.