CVE-2026-35590: libvips EXIF Decoder DoS Vulnerability

CVE-2026-35590 Overview

CVE-2026-35590 is a null pointer dereference vulnerability in libvips, a fast image processing library used in server-side image manipulation pipelines. The flaw resides in the EXIF decoder, which failed to validate the range of EXIF tag groups (Image File Directory, or IFD) before passing data to libexif. Processing a crafted image with a malformed EXIF ifd field causes libvips to dereference a null pointer and crash. All versions up to and including 8.18.1 are affected. The issue is fixed in libvips 8.18.2. The vulnerability is classified under [CWE-122] (Heap-based Buffer Overflow) in the NVD record, though the practical impact reported by the maintainers is a process crash.

Critical Impact
An attacker able to submit a crafted image to a libvips-backed processing pipeline can trigger a null pointer dereference, causing a denial of service in the affected process.

Affected Products

libvips versions up to and including 8.18.1
Applications and services embedding libvips for EXIF-bearing image formats (JPEG, TIFF, HEIF, WebP)
Downstream language bindings (pyvips, ruby-vips, sharp, net-vips) that ship the vulnerable library

Discovery Timeline

2026-07-20 - CVE-2026-35590 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-35590

Vulnerability Analysis

The defect lives in libvips' EXIF decoding path within libvips/foreign/exif.c. Image metadata fields named exif-ifd<N> encode which IFD group a tag belongs to. libvips parses the integer suffix using atoi() and forwards the resulting ifd value to libexif without bounds checking. When the value falls outside the valid [0, EXIF_IFD_COUNT) range, libexif returns a null pointer that libvips subsequently dereferences, terminating the process.

Exploitation requires a local attack vector with low privileges, and no user interaction. The outcome is availability loss for the affected process; confidentiality and integrity are not impacted. EPSS scoring places the probability of observed exploitation at a low level.

Root Cause

The root cause is missing input validation on attacker-influenced metadata. libvips extracted the IFD index from a field name and used it as a lookup index into libexif structures without verifying that the index referenced a valid IFD group. A negative or out-of-range value produced a null pointer that was later dereferenced.

Attack Vector

An attacker crafts an image whose EXIF metadata contains a malformed exif-ifd<N> field, then submits it to any pipeline that decodes EXIF with libvips. Typical exposure surfaces include image upload endpoints, thumbnail generators, and batch processing workers that trust user-supplied files.

// Patch: libvips/foreign/exif.c - validate ifdN in exif decode (#4972)
p = field + strlen("exif-ifd");
ifd = atoi(p);
if (ifd < 0 ||
    ifd >= EXIF_IFD_COUNT) {
    g_warning("bad exif ifd %d in \"%s\"", ifd, field);
    return NULL;
}

for (; g_ascii_isdigit(*p); p++)
    ;

Source: libvips commit 91ebd4d

Detection Methods for CVE-2026-35590

Indicators of Compromise

Unexpected SIGSEGV terminations of processes linking libvips.so when handling image uploads
g_warning log entries containing the string bad exif ifd after the patch is applied, indicating malformed input attempts
Core dumps whose stack traces include libvips EXIF parsing frames and libexif symbols

Detection Strategies

Inventory container images, package repositories, and language-binding dependencies (pyvips, sharp, ruby-vips) to identify libvips builds at 8.18.1 or earlier
Instrument image processing workers to log crashes with full stack traces, and alert on repeated failures tied to a single upload source
Monitor image ingestion endpoints for anomalous EXIF payload structures and repeated 5xx responses from upload handlers

Monitoring Recommendations

Track process restarts and worker crash counts in image processing services, correlating with upload source IPs and user accounts
Enable verbose libvips warnings in non-production environments to capture EXIF parsing anomalies during pre-release testing
Retain image upload samples that trigger worker crashes for offline forensic analysis

How to Mitigate CVE-2026-35590

Immediate Actions Required

Upgrade libvips to version 8.18.2 or later across all hosts, containers, and build pipelines
Rebuild and redeploy applications that statically link or bundle libvips, including serverless functions and container base images
Update language bindings (sharp, pyvips, ruby-vips, net-vips) to releases that package the patched libvips

Patch Information

The fix is committed in libvips as 91ebd4d35341a8353ea490392d556d582e4b846f and shipped in release 8.18.2. Details are available in the libvips GitHub Security Advisory GHSA-jmwm-wc68-mhwm and pull request #4972.

Workarounds

Strip EXIF metadata from user-supplied images before handing them to libvips, using a hardened preprocessor such as exiftool -all= in a sandboxed context
Run image processing workers with automatic restart supervision and per-request memory and time limits to contain crash impact
Restrict upload sources through authentication and rate limiting to reduce the exposure of the local attack surface

bash

# Verify installed libvips version and upgrade
vips --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libvips libvips-tools

# Node.js (sharp)
npm update sharp

# Python (pyvips relies on system libvips)
pip install --upgrade pyvips