Vulnerabilities CVE-2026-35590

CVE-2026-35590

Medium

Open

TLP:CLEAR

Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.

Details

CVSS Score: 6.8
EPSS Score ⓘ: 0.12%

2.1th percentile
CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jul 20, 2026
Last Modified: Jul 20, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.