CVE-2026-35590

6.8 mediumEPSS 0.1%

Medium (6.8) in libvips libvips. EPSS 0.1% chance of exploitation in the next 30 days.

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Severity

CVSS 4.0

6.8 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-122
Published: 2026-07-20
Modified: 2026-08-19
Record from: the NVD, synced 2026-10-19

Affected

libvips:libvips

References

https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f
https://github.com/libvips/libvips/pull/4972
https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm

Check your stack JSON