CVE-2026-35590: Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-08-19
Weakness: CWE-122

Description

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Affected products

libvips: before 8.18.2 — fixed in 8.18.2

How to fix

Upgrade to a fixed version: libvips 8.18.2. Check the vendor advisory for mitigations.

References

https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f
https://github.com/libvips/libvips/pull/4972
https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm

Get alerted when CVE-2026-35590 or the next vulnerability affects your stack