CVE-2026-35591 in libvips
Summary
by MITRE • 07/20/2026
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in libvips affects the tiffload operation when processing TIFF images containing JPEG or JPEG2000 encoded tiles, representing a critical buffer overflow risk that could be exploited by attackers. This flaw stems from incorrect channel count determination during image parsing, where the library fails to properly validate the number of color channels in compressed image data. The issue specifically impacts versions prior to 8.18.2, making it a regression that affects widespread deployments of the image processing library. When libvips encounters such malformed or improperly structured TIFF files with embedded JPEG/JPEG2000 tiles, the incorrect channel calculation leads to memory allocation errors that can result in buffer overflows. These buffer overflows occur because the library attempts to write data beyond allocated memory boundaries when handling the misreported channel information during decompression processes.
The technical implementation of this vulnerability involves the TIFF image loading subsystem where libvips parses tile structures containing compressed image data. When processing JPEG or JPEG2000 encoded tiles within TIFF containers, the library incorrectly computes channel counts based on incomplete or malformed metadata within the tile headers. This computational error propagates through the memory management system, causing subsequent buffer operations to exceed allocated bounds. The flaw manifests particularly when the embedded JPEG/JPEG2000 data contains channel information that differs from what libvips expects during its internal parsing logic. This type of vulnerability aligns with CWE-121 Stack-based Buffer Overflow and CWE-787 Out-of-bounds Write classifications, representing a classic memory corruption issue in image processing libraries that handle multiple compression formats.
The operational impact of this vulnerability extends across numerous applications that rely on libvips for image processing tasks including web servers, content management systems, digital asset management platforms, and image editing software. Attackers could potentially exploit this vulnerability through crafted TIFF files delivered via email attachments, web uploads, or file sharing systems, leading to remote code execution or denial of service conditions. The vulnerability affects both local and network-based attack scenarios since many applications that use libvips process user-provided content without proper validation. Systems running versions prior to 8.18.2 remain exposed to potential exploitation when processing untrusted TIFF files containing JPEG/JPEG2000 encoded tiles, making this a significant risk for organizations relying on image processing workflows.
Mitigation strategies should prioritize immediate upgrade to libvips version 8.18.2 or later where the vulnerability has been patched through improved channel count validation and memory boundary checking during TIFF tile processing. Organizations should implement additional input validation measures including MIME type verification, file format detection, and size limitations for uploaded image files to reduce exploitation surface area. Security teams should deploy network intrusion detection systems capable of identifying suspicious TIFF file patterns and monitor for potential exploitation attempts targeting this specific vulnerability. The patch addresses the root cause by implementing proper channel count validation within the tiffload operation and includes enhanced bounds checking mechanisms that prevent buffer overflows during compressed image data processing. Additionally, application-level sandboxing and restricted execution environments should be considered as defensive measures to limit potential impact if exploitation occurs despite these mitigations.