vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-70651

libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick

MEDIUM
6.9
CVSS Score
Published: August 20, 2026 at 09:05 PM UTC
Updated: October 26, 2026 at 10:10 AM UTC
1 product affected across 1 vendorLibvips

Using libvips by libvips?

Get instant alerts when new vulnerabilities affect libvips - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.9
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Libvips· Libvips
90%
v < 8.18.3
Affected range stops below 8.18.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

x_refsource_CONFIRM
Source: cverecord
https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4
x_refsource_MISC
Source: cverecord
https://github.com/libvips/libvips/pull/5040
x_refsource_MISC
Source: cverecord
https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11
x_refsource_MISC
Source: cverecord
https://github.com/libvips/libvips/releases/tag/v8.18.3

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.9MEDIUMGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-680

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card