CVE-2026-70651 in libvips
Summary
by MITRE • 08/21/2026
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in the libvips image processing library represents a critical memory safety flaw within its ImageMagick integration layer, specifically affecting versions prior to 8.18.3. Libvips is widely utilized for high-performance image manipulation due to its efficiency and low memory footprint, but this specific implementation detail introduces a significant risk when handling multi-page TIFF files through the MagickForeignLoad mechanism. The core of the issue lies in how the library calculates buffer sizes during the loading process. When libvips is compiled without native libtiff support and falls back to using ImageMagick as the backend for TIFF parsing, it engages code paths located in foreign/magick6load.c and foreign/magick7load.c. These modules are responsible for interpreting multi-frame images, such as animated GIFs or multi-page TIFFs, by iterating through each frame and aggregating their dimensions to allocate necessary memory buffers.
The technical flaw is a classic integer overflow leading to an out-of-bounds read condition. Specifically, the vulnerable code calculates the total required height of the image buffer by multiplying the Y-size (height) of a single page by the number of frames detected in the file. This multiplication operation lacks any bounds checking or validation against potential maximum limits before performing the arithmetic. If a crafted multi-page TIFF is provided with frame dimensions and counts that result in an integer overflow, the calculated size may wrap around to a significantly smaller value than actually required. Consequently, the application allocates a heap buffer that is far too small to hold the actual image data. When libvips proceeds to read or process this data into the undersized buffer, it triggers a heap buffer over-read. This memory corruption can lead to immediate process crashes due to segmentation faults or, in more complex scenarios involving specific exploitation techniques, potentially allow for information disclosure if the out-of-bounds read accesses sensitive memory regions adjacent to the allocated buffer.
From an operational perspective, this vulnerability poses a substantial risk to any service that processes user-uploaded images using libvips with ImageMagick fallback support. While many standard package-manager builds of libvips include native libtiff support and thus bypass this vulnerable code path entirely, environments running custom compilations or older distributions may still be exposed. An attacker could craft a malicious multi-page TIFF file designed to trigger the integer overflow condition. Upon ingestion by a vulnerable service, such as an image processing API, photo hosting platform, or document conversion tool, this would result in denial of service through application crashes. In cases where the over-read exposes adjacent memory contents, there is also a risk of leaking internal state information, which could aid further exploitation attempts against the host system.
This vulnerability aligns with CWE-190, Integer Overflow or Wraparound, as the root cause is the failure to validate arithmetic operations involving user-controlled input values. Furthermore, it relates to CWE-125, Out-of-bounds Read, describing the actual memory access violation that occurs when processing the malformed data. In terms of adversarial tactics, this flaw can be leveraged within ATT&CK technique T1059, Command and Control, or more commonly in initial exploitation phases as part of a Denial of Service attack vector (T1499) to disrupt service availability by crashing critical infrastructure components that rely on image processing. The lack of input validation for frame counts and dimensions is a common pattern in legacy multimedia parsers where performance optimizations sometimes bypass rigorous security checks.
Mitigation strategies must prioritize updating the libvips library to version 8.18.3 or later, which includes patches ensuring proper bounds checking during buffer size calculations. For organizations unable to immediately update due to dependency constraints, implementing input validation at the application layer is recommended. This involves validating image metadata before passing it to the processing engine and rejecting files with excessive frame counts or unreasonable dimension combinations. Additionally, deploying runtime protection mechanisms such as Address Sanitizers in development environments can help detect similar memory safety issues early in the software lifecycle. Ensuring that libvips builds include native libtiff support where possible also reduces reliance on the vulnerable ImageMagick fallback path, thereby narrowing the attack surface for this specific class of vulnerabilities.