CVE-2026-35590 in libvips
Summary
by MITRE • 07/20/2026
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in libvips affects the EXIF decoder component that processes image metadata within the fast image processing library. This issue specifically manifests in versions prior to and including 8.18.1 where the library fails to properly validate the range of EXIF tag groups before delegating data handling to the underlying libexif library. The lack of proper input validation creates a condition where malformed or unexpected EXIF data can trigger unintended behavior in the processing pipeline.
The technical flaw represents a classic null pointer dereference vulnerability that occurs when the EXIF decoder does not perform adequate bounds checking on tag group identifiers. When malicious or corrupted EXIF data is processed, the decoder attempts to access memory locations that may be null or invalid, leading to application crashes and potential denial of service conditions. This type of vulnerability falls under CWE-476 which specifically addresses null pointer dereference issues in software implementations.
The operational impact of this vulnerability extends beyond simple application instability as it creates a potential attack surface for adversaries seeking to disrupt image processing workflows. Systems that rely on libvips for automated image handling, web applications processing user-uploaded images, or content management systems utilizing the library could experience service interruptions when encountering malformed EXIF data. The vulnerability is particularly concerning in environments where untrusted image files are processed, as attackers could craft specially formatted images designed to trigger the crash condition.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1499 which covers network denial of service attacks and system manipulation through application crashes. The patched version 8.18.2 addresses this issue by implementing proper range validation checks before EXIF tag group data is passed to libexif, thereby preventing the null pointer dereference condition. Organizations should prioritize updating their libvips installations to version 8.18.2 or later to mitigate this risk. Additionally, implementing input validation measures at the application level and using sandboxed processing environments can provide additional defense in depth against similar vulnerabilities in image processing pipelines.