CVE-2026-35590
Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
| CWE | CWE-122 |
| Vendor | libvips |
| Product | libvips |
| Published | Jul 20, 2026 |
| Last Updated | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for libvips libvips
Be the first to know when new unknown vulnerabilities affecting libvips libvips are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
libvips / libvips
<= 8.18.1