Vulnerability Description
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libvips | Libvips | < 8.18.2 |
Related Weaknesses (CWE)
References
- https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b84Patch
- https://github.com/libvips/libvips/pull/4972Issue TrackingPatch
- https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwmVendor Advisory
FAQ
What is CVE-2026-35590?
CVE-2026-35590 is a vulnerability with a CVSS score of 5.5 (MEDIUM). libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing dat...
How severe is CVE-2026-35590?
CVE-2026-35590 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35590?
Check the references section above for vendor advisories and patch information. Affected products include: Libvips Libvips.