CVE-2026-88360: libvips PFM Image Processing DoS Vulnerability

CVE-2026-88360 Overview

CVE-2026-88360 is a memory access vulnerability in libvips 8.19.0 affecting the processing of little-endian PFM (Portable FloatMap) images. The flaw occurs when the PFM text header length is not a multiple of four bytes. The mmap-based loader exposes pixel data at an address that is not properly aligned for float access. The function vips_avg_scan() later dereferences the buffer through a float pointer, triggering undefined behavior. On strict-alignment architectures or UBSan-instrumented builds, the process terminates, resulting in denial of service.

Critical Impact
Attackers can craft a malicious PFM image to crash applications that use libvips for image processing, enabling denial of service on strict-alignment architectures.

Affected Products

libvips 8.19.0
Applications embedding the libvips mmap-based PFM loader
Services using libvips on strict-alignment architectures or UBSan-instrumented builds

Discovery Timeline

2026-09-24 - CVE CVE-2026-88360 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-88360

Vulnerability Analysis

The vulnerability resides in libvips 8.19.0's PFM image loader. PFM files begin with a text header followed by binary floating-point pixel data. When libvips loads these files, it uses memory-mapped I/O (mmap) to expose the pixel buffer directly to downstream processing routines.

The loader does not pad or copy pixel data to a four-byte boundary when the text header length is not a multiple of four bytes. As a result, the pixel region begins at a misaligned address relative to a float boundary.

Downstream, vips_avg_scan() casts and dereferences the buffer through a float pointer. On architectures that tolerate unaligned loads this may silently produce incorrect results, but on strict-alignment platforms the CPU raises a bus error and terminates the process. UBSan-instrumented builds abort when the misaligned access is detected.

Root Cause

The root cause is an unchecked alignment assumption in the mmap-based PFM loader. The code assumes mmap-exposed pixel data meets the alignment requirements of a float pointer, but PFM header length is attacker-controlled. Any header length not divisible by four produces a misaligned pixel region. This is an input validation failure that interacts with a type-punning read in the averaging routine.

Attack Vector

An attacker supplies a crafted little-endian PFM image whose text header length is not a multiple of four bytes. When a victim application processes the image through libvips (for example, during thumbnail generation, image conversion, or metadata extraction), vips_avg_scan() performs an unaligned float dereference. On ARM, SPARC, or UBSan-instrumented builds the process terminates, causing denial of service for the image processing pipeline.

The vulnerability does not require authentication beyond whatever controls govern image upload. Services that automatically process user-supplied images are the primary exposure. Refer to the GitHub Issue Discussion for additional technical context.

Detection Methods for CVE-2026-88360

Indicators of Compromise

Repeated crashes or SIGBUS terminations in processes linking libvips 8.19.0 when handling PFM uploads
UBSan runtime errors referencing misaligned load of type float originating in vips_avg_scan()
Spikes in failed image-processing jobs correlated with PFM file submissions

Detection Strategies

Inventory running software to identify services and containers that depend on libvips 8.19.0
Inspect image-ingestion logs for PFM files, especially those with non-standard header lengths
Replay suspicious PFM samples through a UBSan-instrumented libvips build to confirm the alignment fault

Monitoring Recommendations

Alert on abnormal child-process termination signals (SIGBUS, SIGABRT) from image-processing workers
Monitor file-upload endpoints for PFM MIME types or PF/Pf magic headers
Track crash frequency per upstream client IP to detect targeted denial-of-service attempts

How to Mitigate CVE-2026-88360

Immediate Actions Required

Identify all deployments running libvips 8.19.0 and prioritize those processing untrusted image input
Disable or restrict the PFM loader where feasible until a patched release is applied
Place image-processing workers behind supervisors that restart on crash to limit service disruption

Patch Information

No fixed version was listed in the NVD record at publication. Monitor the upstream libvips repository and the GitHub Issue Discussion for a patched release and apply it when available.

Workarounds

Reject PFM files at the application boundary when the format is not required
Validate PFM header length and refuse files whose header is not a multiple of four bytes before passing data to libvips
Run image-processing workloads on x86_64 without UBSan instrumentation where alignment faults are tolerated, as a temporary mitigation only

bash

# Example: block PFM uploads at an nginx reverse proxy
location /upload {
    if ($http_content_type ~* "image/x-portable-floatmap") {
        return 415;
    }
    client_max_body_size 10m;
    proxy_pass http://image_backend;
}