CVE-2026-35591: libvips Buffer Overflow Vulnerability

CVE-2026-35591 Overview

CVE-2026-35591 is a heap-based buffer overflow [CWE-122] in libvips, a fast image processing library widely used in web services and image conversion pipelines. The tiffload operation in libvips versions up to and including 8.18.1 fails to correctly determine the number of channels in a JPEG or JPEG2000-encoded tile embedded within a TIFF image. An attacker who supplies a crafted TIFF file can trigger a buffer overflow during decoding. The libvips maintainers patched the issue in version 8.18.2.

Critical Impact
Processing a maliciously crafted TIFF file with JPEG or JP2K-encoded tiles can trigger a heap buffer overflow in libvips, potentially leading to memory corruption and code execution in the context of the loading process.

Affected Products

libvips versions ≤ 8.18.1
Applications embedding libvips for TIFF decoding through the tiffload operation
Downstream language bindings that expose tiffload (pyvips, sharp, ruby-vips, and similar wrappers)

Discovery Timeline

2026-07-20 - CVE-2026-35591 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-35591

Vulnerability Analysis

The flaw resides in the TIFF loader path (tiffload) when a TIFF container carries tiles compressed with JPEG or JPEG2000. The loader must reconcile the component count reported by the inner JPEG or JP2K codec against the channel count declared by the outer TIFF metadata. Prior to 8.18.2, the loader did not validate that these values matched or fell within expected bounds. When mismatched, downstream buffer allocations were sized for one channel count while decode routines wrote data for another. This mismatch produces an out-of-bounds heap write, a classic heap buffer overflow condition tracked as [CWE-122].

Root Cause

The root cause is missing validation of the numcomps field returned by the JPEG2000 codec (OpenJPEG) and equivalent component checks for the embedded JPEG decoder. The upstream fix, titled "tiffload: check jpeg and jp2k components," adds explicit validation in vips_foreign_load_jp2k_check_supported() and the JPEG path so that images with zero components or more than MAX_BANDS are rejected before allocation.

Attack Vector

Exploitation requires the victim to load an attacker-supplied TIFF file through libvips. The CVSS 4.0 vector indicates a local attack vector with low privileges required and no user interaction beyond triggering image processing. In practice, any service that accepts uploaded images and pipes them through libvips (thumbnail generators, CMS upload handlers, image conversion APIs) exposes this attack surface remotely, even though the base vector is classed as local.

/* Is an image a type we handle? We don't support various strange jp2k types.
 */
static int
vips_foreign_load_jp2k_check_supported(opj_image_t *image)
{
	if (image->numcomps > MAX_BANDS) {
		vips_error("jp2kload", "%s", _("too many image bands"));
		return -1;
	}
	if (image->numcomps == 0) {
		vips_error("jp2kload", "%s", _("no image components"));
		return -1;
	}

Source: libvips commit df044e4

Detection Methods for CVE-2026-35591

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking against libvips.so when handling TIFF inputs
TIFF files containing JPEG or JP2K compressed tiles with anomalous or zero component counts in the codestream
Image upload endpoints producing worker restarts, core dumps, or heap corruption traces referencing vips_foreign_load_tiff or jp2kload

Detection Strategies

Inventory all applications and containers that ship libvips and identify versions ≤ 8.18.1 using package managers or SBOM tooling
Enable AddressSanitizer or GWP-ASan in test environments to surface the overflow when processing sample TIFF corpora
Correlate image-processing worker crashes with the filenames and source IPs of recently uploaded TIFF files

Monitoring Recommendations

Log stderr and crash output from image-processing workers and forward to a centralized logging pipeline
Alert on repeated libvips decoder errors or abnormal termination of image conversion jobs
Monitor upload endpoints for TIFF files with embedded JPEG2000 codestreams and flag oversized or malformed samples

How to Mitigate CVE-2026-35591

Immediate Actions Required

Upgrade libvips to version 8.18.2 or later across all systems, containers, and base images
Rebuild and redeploy applications that statically link libvips or bundle it inside container images
Update language bindings (pyvips, sharp, ruby-vips, node-vips) once they package the patched libvips release

Patch Information

The fix is available in libvips 8.18.2. It is delivered by commit df044e4 and pull request #4973. Full details are published in the GitHub Security Advisory GHSA-523x-vhfw-6r76.

Workarounds

Disable or restrict TIFF loading in libvips-based services if patching cannot occur immediately
Reject uploaded TIFF files with JPEG or JPEG2000 tile compression at the application layer using a pre-validation step
Sandbox image-processing workers with seccomp, gVisor, or a dedicated container to limit the blast radius of memory corruption

bash

# Verify the installed libvips version and upgrade
vips --version
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libvips42
# From source
git clone https://github.com/libvips/libvips.git
cd libvips && git checkout v8.18.2
meson setup build --prefix=/usr/local && ninja -C build && sudo ninja -C build install