CVE-2026-69242

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/libvips/libvips/commit/c72f50927413cd2451837d9813f954bc5d88f548
https://github.com/libvips/libvips/pull/5012
https://github.com/libvips/libvips/releases/tag/v8.18.3
https://github.com/libvips/libvips/security/advisories/GHSA-9rwc-f68v-4482

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) libvips es una biblioteca de procesamiento de imágenes rápida con bajas necesidades de memoria. Antes de la versión 8.18.3, un TIFF de múltiples bandas manipulado procesado a través de VipsForeignLoadTiff puede evadir la validación de línea de escaneo en libvips/iofuncs/image.c y causar un desbordamiento de entero en vips_image_sanity. El cálculo resultante de la región del búfer puede acceder a desplazamientos negativos controlados por el atacante en asignaciones residentes en mmap, permitiendo lecturas o escrituras de otros datos de imagen, posible divulgación de datos a través de la salida .v sin comprimir, y probables fallos del proceso. La ejecución remota de código no ha sido demostrada pero no puede descartarse. Este problema está solucionado en la versión 8.18.3.

Information

Published : 2026-08-20 21:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-69242

Mitre link : CVE-2026-69242

CVE.ORG link : CVE-2026-69242

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-69242", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69242", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T16:19:58.384513Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}]}], "published": "2026-08-20T21:17:07.697", "references": [{"url": "https://github.com/libvips/libvips/commit/c72f50927413cd2451837d9813f954bc5d88f548", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/pull/5012", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/libvips/libvips/security/advisories/GHSA-9rwc-f68v-4482", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3."}, {"lang": "es", "value": "libvips es una biblioteca de procesamiento de im\u00e1genes r\u00e1pida con bajas necesidades de memoria. Antes de la versi\u00f3n 8.18.3, un TIFF de m\u00faltiples bandas manipulado procesado a trav\u00e9s de VipsForeignLoadTiff puede evadir la validaci\u00f3n de l\u00ednea de escaneo en libvips/iofuncs/image.c y causar un desbordamiento de entero en vips_image_sanity. El c\u00e1lculo resultante de la regi\u00f3n del b\u00fafer puede acceder a desplazamientos negativos controlados por el atacante en asignaciones residentes en mmap, permitiendo lecturas o escrituras de otros datos de imagen, posible divulgaci\u00f3n de datos a trav\u00e9s de la salida .v sin comprimir, y probables fallos del proceso. La ejecuci\u00f3n remota de c\u00f3digo no ha sido demostrada pero no puede descartarse. Este problema est\u00e1 solucionado en la versi\u00f3n 8.18.3."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "security-advisories@github.com"}