VULNERABILITY INTELLIGENCE

CVE-2026-35590

CVSS score5.5 MEDIUM
EPSS probability0.15%
CISA KEVNot currently listed
Published2026-07-20
Last modified2026-08-19
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Weakness classification

  • security-advisories@github.com: CWE-122

Primary references