DEBIAN-CVE-2026-2913
A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."
DEBIAN-CVE-2026-2913
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-2913
vips
Source reference: /affected/0/package/name
- Affected versions
- 8.14.1-3
Source reference:
/affected/0/versions8.14.1-3+deb12u1Source reference:
/affected/0/versions8.14.1-3+deb12u2Source reference:
/affected/0/versions - Fixed versions
- 8.14.1-3+deb12u3
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
vips
Source reference: /affected/1/package/name
- Affected versions
- 8.16.1-1
Source reference:
/affected/1/versions - Fixed versions
- 8.16.1-1+deb13u1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
vips
Source reference: /affected/2/package/name
- Affected versions
- 8.16.1-1
Source reference:
/affected/2/versions8.16.1-2Source reference:
/affected/2/versions8.17.3-1Source reference:
/affected/2/versions8.17.3-2Source reference:
/affected/2/versions8.18.0-1Source reference:
/affected/2/versions - Fixed versions
- 8.18.0-2
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.14.1-3+deb12u3"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/debian/vips?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"8.14.1-3",
"8.14.1-3+deb12u1",
"8.14.1-3+deb12u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2913.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.16.1-1+deb13u1"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/debian/vips?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8.16.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2913.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.18.0-2"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/debian/vips?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.16.1-1",
"8.16.1-2",
"8.17.3-1",
"8.17.3-2",
"8.18.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2913.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56715 · Revision 1
- Added to Heist Feed
- Publisher date