CVE-2026-33328: libvips Buffer Overflow Vulnerability

CVE-2026-33328 Overview

CVE-2026-33328 is an integer overflow vulnerability [CWE-190] in libvips, a fast image processing library used in many web and media pipelines. The flaw resides in the gifload operation and affects 32-bit systems running libvips versions up to and including 8.18.0. When processing a GIF, dimension calculations can overflow, leading to incorrect buffer sizing. The issue was addressed in libvips 8.18.1.

Critical Impact
A local attacker who supplies a crafted GIF to a libvips-based workflow on a 32-bit host can trigger an integer overflow in gifload, resulting in memory corruption or process termination.

Affected Products

libvips versions up to and including 8.18.0 on 32-bit platforms
Applications and services that call the gifload operation via libvips bindings
Downstream tools embedding libvips for image ingestion or transcoding

Discovery Timeline

2026-07-20 - CVE-2026-33328 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-33328

Vulnerability Analysis

The vulnerability lives in vips_foreign_load_nsgif_bitmap_create inside libvips/foreign/nsgifload.c. The function validates width and height against the GIF specification limit of 64k per axis but never checks the product of the two values. On 32-bit systems, multiplying width by height and then by four bytes per pixel can exceed INT_MAX, wrapping the result to a smaller value.

The overflowed value is used to size the pixel buffer. Downstream code then writes decoded pixel data past the end of the undersized allocation, producing heap corruption or aborting the process. Because libvips is commonly used behind server-side image upload endpoints, attacker-supplied GIFs can reach the vulnerable path.

Root Cause

The root cause is missing arithmetic overflow protection in the dimension validation logic. Individual bounds checks on width and height are insufficient because they do not account for how the multiplied pixel count is later scaled by the pixel size and stored in an int.

Attack Vector

Exploitation requires a local attacker with low privileges who can submit a crafted GIF to a process using libvips gifload on a 32-bit host. No user interaction is required. The primary impact is on availability, though heap corruption in decode paths can extend to broader memory safety issues depending on the calling application.

 vips_foreign_load_nsgif_bitmap_create(int width, int height)
 {
 	/* GIF has a limit of 64k per axis -- double-check this.
+	 *
+	 * gifsave also enforces a pixel count limit, apply the same
+	 * constraint here.
 	 */
 	if (width <= 0 ||
-		width > 65536 ||
+		width > 65535 ||
 		height <= 0 ||
-		height > 65536) {
+		height > 65535 ||
+		(guint64) width * height > INT_MAX / 4) {
 		vips_error("gifload",
 			"%s", _("bad image dimensions"));
 		return NULL;

Source: libvips commit 9b633e4. The patch tightens the per-axis limit to 65535 and adds a 64-bit multiplication check against INT_MAX / 4 before the allocation proceeds.

Detection Methods for CVE-2026-33328

Indicators of Compromise

Unexpected crashes or SIGABRT signals from processes linking libvips when handling GIF inputs on 32-bit hosts.
Repeated gifload failures logged as bad image dimensions from untrusted upload sources.
Anomalous memory growth or worker restarts in image processing services following GIF uploads.

Detection Strategies

Inventory hosts and containers running 32-bit builds of libvips at version 8.18.0 or earlier using software composition analysis.
Instrument image ingestion services with input logging that records file type, declared dimensions, and origin for each gifload call.
Correlate application crash telemetry with recent GIF processing events to identify probing attempts.

Monitoring Recommendations

Alert on libvips process exits with non-zero status codes on servers exposed to user-supplied images.
Monitor upload endpoints for GIF files whose logical width times height exceeds practical thumbnailing needs.
Track library version drift so that hosts remaining on 8.18.0 or earlier are flagged for remediation.

How to Mitigate CVE-2026-33328

Immediate Actions Required

Upgrade libvips to version 8.18.1 or later on all 32-bit systems where the library is installed.
Rebuild or repackage any application bundling libvips statically so the fixed nsgifload.c code is in the shipped binary.
Restrict which users and services can submit GIFs to libvips-backed pipelines until patching is complete.

Patch Information

The fix is in libvips 8.18.1, delivered by commit 9b633e4 via pull request #4935. Additional context is available in the GitHub Security Advisory GHSA-r98w-4fp7-m9c7.

Workarounds

Migrate 32-bit workloads that process GIFs to 64-bit builds where the overflow condition is not reachable through the same code path.
Enforce upstream input validation to reject GIFs whose declared width multiplied by height exceeds a safe pixel budget before invoking libvips.
Disable GIF handling in libvips-based services if patching cannot be scheduled immediately.

bash

# Verify installed libvips version and upgrade
vips --version
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libvips libvips-tools
# From source
git clone https://github.com/libvips/libvips.git
cd libvips && git checkout v8.18.1 && meson setup build && ninja -C build install