CVE-2026-88360 in libvips
Summary
by MITRE • 09/24/2026
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in libvips version 8.19.0 represents a critical memory safety issue rooted in improper handling of data alignment during the processing of Portable Float Map (PFM) image files. PFM is an extension of the Netpbm format designed to store high dynamic range images using floating-point values, which necessitates strict adherence to byte alignment for efficient and correct access by modern processors. The specific flaw resides within the memory-mapped file loader component responsible for parsing these files. When a PFM image contains a text header whose length is not an exact multiple of four bytes, the resulting offset where pixel data begins in memory becomes misaligned relative to the requirements for floating-point operations. This structural inconsistency arises because the loader fails to adjust the starting address or pad the input stream appropriately before mapping it into virtual memory space.
From a technical perspective, this misalignment triggers undefined behavior when subsequent processing functions attempt to access the raw pixel data as an array of floats. The function vips_avg_scan(), which calculates average values across image scans, dereferences the buffer using a pointer typed for float objects. On architectures that enforce strict alignment rules, such as ARM or certain configurations of x86_64 with specific compiler flags, accessing unaligned memory addresses via floating-point pointers results in hardware exceptions or segmentation faults. Even on more permissive architectures like standard Intel processors where unaligned access might silently produce incorrect data or performance penalties, the behavior remains undefined according to C language standards and can lead to unpredictable outcomes including crashes or corrupted calculations.
The operational impact of this vulnerability is primarily a denial of service condition for applications relying on libvips for image processing workflows. An attacker who can supply a crafted PFM file with an improperly aligned header length can cause the consuming application to terminate abruptly upon attempting to process the image. This disruption affects any system integrating libvips, including web servers handling uploaded images, digital asset management systems, and automated media pipelines. The severity is compounded by the fact that this behavior manifests specifically in strict-alignment environments or builds instrumented with Undefined Behavior Sanitizer (UBSan), making it a reliable crash vector for targeted attacks against hardened deployments.
This vulnerability aligns with Common Weakness Enumeration category CWE-128, which covers Wrap-around Errors leading to incorrect pointer arithmetic and memory access issues, as well as aspects of CWE-754, Improper Check or Unusual Handling of Exceptional Conditions, due to the failure to validate header length constraints before processing. In terms of attack vectors, this falls under ATT&CK technique T1068 Exploitation for Privilege Escalation if used in conjunction with other flaws, but primarily represents a resource exhaustion vector similar to T1499 Endpoint Denial of Service through application crashes. Mitigation strategies involve upgrading libvips to patched versions where the loader explicitly checks header alignment and adjusts memory mapping offsets accordingly. Developers integrating this library should also implement input validation at the API level to reject malformed PFM files before they reach the internal processing routines, thereby adding a layer of defense against potential exploitation attempts targeting image parsing subsystems.