CVE-2026-33327: libvips Buffer Overflow Vulnerability

CVE-2026-33327 Overview

CVE-2026-33327 is an integer overflow vulnerability [CWE-190] in libvips, a widely used fast image processing library. The vipsload operation in versions up to and including 8.18.0 incorrectly determines image dimensions during load. This miscalculation triggers an integer overflow that leads to a subsequent heap-based buffer overflow. An attacker who can supply or influence a crafted .vips image file processed by an affected application can corrupt heap memory. The issue was patched in libvips 8.18.1.

Critical Impact
Successful exploitation can corrupt heap memory in any process using libvips to load untrusted .vips images, potentially enabling code execution or denial of service with the privileges of the loading process.

Affected Products

libvips versions up to and including 8.18.0
Applications and services embedding the vulnerable libvips vipsload operation
Downstream language bindings (pyvips, ruby-vips, sharp, etc.) that expose vipsload on untrusted input

Discovery Timeline

2026-07-20 - CVE-2026-33327 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-33327

Vulnerability Analysis

The defect resides in the vipsload operation, which reads native .vips image files. During load, libvips computes buffer sizes from image dimension fields (Xsize, Ysize, bands, and element size) taken from the file header. When these values are multiplied to derive per-line, per-plane, or per-image byte counts, the arithmetic can wrap around the 64-bit boundary. The wrapped value produces an undersized allocation while later code writes based on the original oversized logical dimensions, yielding a heap-based buffer overflow.

The upstream fix adds explicit dimension sanity checks in vips_image_sanity() inside libvips/iofuncs/image.c, computing element size (es), pixel size (ps), line size (ls), and total image size (sizeof_image) as guint64 and validating them before use.

Root Cause

The root cause is missing overflow guards when combining attacker-controlled image dimensions [CWE-190]. Prior code validated only that Xsize and Ysize were positive, but did not bound their product against the maximum representable size for buffer allocations.

Attack Vector

Exploitation requires the victim process to load a crafted .vips file through the vipsload operation. The CVSS vector indicates a local attack path with low privileges required and no user interaction, aligning with scenarios where a low-privileged local user submits an image to a service using libvips.

text

- convasep: use unsigned accumulator where appropriate [kleisauke]
- min: fix possible OOB read with complex images [kleisauke]
- max: fix possible OOB read with complex images [kleisauke]
+- guard against dimension overflow [ElhananHaenel] [kleisauke]

17/12/25 8.18.0

Source: GitHub commit 61e71c1

The patch introduces guint64 accumulators in vips_image_sanity() to detect dimension overflow before allocations occur:

vips_image_sanity(VipsObject *object, VipsBuf *buf)
{
    VipsImage *image = VIPS_IMAGE(object);
    guint64 es, ps, ls, sizeof_image;

    if (image->Xsize <= 0 ||
        image->Ysize <= 0 ||

Source: libvips/iofuncs/image.c patch

Detection Methods for CVE-2026-33327

Indicators of Compromise

Unexpected crashes (SIGSEGV, SIGABRT, or glibc heap corruption messages) in processes linked against libvips.so when handling .vips files
.vips files with abnormally large Xsize, Ysize, or bands header fields uploaded to image-processing endpoints
Core dumps referencing vips_image_sanity, vipsload, or image I/O functions in libvips/iofuncs/image.c

Detection Strategies

Inventory hosts and containers for libvips versions at or below 8.18.0 using package managers or SBOM tooling
Enable AddressSanitizer or hardened malloc in test environments to catch heap overflows during regression fuzzing of image inputs
Monitor application logs for vips_image_sanity errors after upgrading, which indicate that malformed dimension inputs are being rejected

Monitoring Recommendations

Alert on repeated crashes of image workers (e.g., ImageMagick/libvips-backed services, thumbnailers) originating from the same user or IP
Track upload of files with the .vips extension or MIME types associated with libvips native format on internet-facing services
Capture EDR telemetry for child process termination and memory access violations in web application workers that embed libvips

How to Mitigate CVE-2026-33327

Immediate Actions Required

Upgrade libvips to version 8.18.1 or later on all systems, containers, and base images
Rebuild and redeploy applications that statically link or bundle libvips, including language bindings such as pyvips, ruby-vips, and sharp
Restrict acceptance of .vips native format on untrusted upload paths until patched libraries are deployed

Patch Information

The vulnerability is fixed in libvips 8.18.1 via commit 61e71c13328ed72d0a530dffc19b9b225072bdf9, which adds dimension overflow guards in vips_image_sanity(). See the GitHub Security Advisory GHSA-2fcj-gj27-279x and Pull Request #4934 for full details.

Workarounds

Disable or block the vipsload operation for untrusted input by whitelisting only required loaders (e.g., JPEG, PNG, WebP)
Enforce maximum image dimension and file size limits at the application layer before invoking libvips
Sandbox image processing workers with seccomp, AppArmor, or containers with minimal privileges to limit blast radius

bash

# Verify installed libvips version and upgrade
vips --version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libvips42

# RHEL/Fedora
sudo dnf upgrade vips

# Container base image example (Dockerfile)
RUN apt-get update && apt-get install -y libvips42=8.18.1-* && rm -rf /var/lib/apt/lists/*