Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

libvips — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in libvips, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting the libvips image processing library, specifically focusing on weaknesses within its core image handling and filtering modules. The collection encompasses a wide spectrum of issues ranging from memory corruption and buffer overflows to improper input validation and denial-of-service conditions, covering reported flaws from the project's inception through the most recent security updates. Visitors can utilize this resource to track official vendor advisories for libvips, analyze the prevalence and evolution of specific weakness classes within image processing software, or review the complete historical vulnerability record for this product to assess long-term security posture. The data presented here is derived from public disclosures and vulnerability databases, offering a consolidated view of risks without requiring cross-referencing of multiple sources. By examining the trends and patterns displayed, security professionals and developers can better understand the attack surface of libvips and implement appropriate mitigations. This aggregation serves as a factual reference for incident response, risk assessment, and secure coding practices related to image manipulation libraries, ensuring that users remain informed about potential threats in their software supply chain.

Vendor: libvips

CVE ID Title CVSS Severity Published
CVE-2026-70654 libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow CWE-122 5.8 Medium 2026-08-20
CVE-2026-70653 libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image CWE-122 4.8 Medium 2026-08-20
CVE-2026-70651 libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick CWE-680 6.9 Medium 2026-08-20
CVE-2026-70652 libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map CWE-126 2.0 Low 2026-08-20
CVE-2026-69242 libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write CWE-122 8.4 High 2026-08-20
CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile CWE-122 - - 2026-07-20
CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata CWE-122 - - 2026-07-20
CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images CWE-190 - - 2026-07-20
CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow CWE-190 - - 2026-07-20
CVE-2026-6491 libvips nip2 vips7compat.c im_minpos_vec heap-based overflow CWE-122 5.3 Medium 2026-04-17
CVE-2026-3284 libvips extract.c vips_extract_area_build integer overflow CWE-190 3.3 Low 2026-02-27
CVE-2026-3283 libvips extract.c vips_extract_band_build out-of-bounds CWE-125 3.3 Low 2026-02-27
CVE-2026-3282 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds CWE-125 3.3 Low 2026-02-27
CVE-2026-3281 libvips bandrank.c vips_bandrank_build heap-based overflow CWE-122 5.3 Medium 2026-02-27
CVE-2026-3147 libvips csvload.c vips_foreign_load_csv_build heap-based overflow CWE-122 5.3 Medium 2026-02-25
CVE-2026-3146 libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference CWE-476 3.3 Low 2026-02-25
CVE-2026-3145 libvips matrixload.c vips_foreign_load_matrix_header memory corruption CWE-119 5.3 Medium 2026-02-25
CVE-2026-2913 libvips source.c vips_source_read_to_memory heap-based overflow CWE-122 2.5 Low 2026-02-22
CVE-2025-59933 libvips is vulnerable to Buffer Over-Read in poppler-based pdfload CWE-126 8.8AI High AI 2025-09-29
CVE-2025-29769 libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output CWE-122 5.5AI Medium AI 2025-04-07
CVE-2023-40032 Potential segfault due to NULL pointer dereference in libvips CWE-476 5.5 Medium 2023-09-11

All 21 known CVE vulnerabilities affecting libvips with full Chinese analysis, references, and POCs where available.