libvips v8.18.2

{
  "id": "102436b912f4674e2241288d1f3abf1e1fcec1f3f5a4d2b49a9b59eff847a633",
  "url": "https://github.com/libvips/libvips/releases/tag/v8.18.2",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "libvips v8.18.2",
    "summary": "libvips v8.18.2 includes fixes for several input-validation and bounds-checking issues.",
    "evidence": "Changes since 8.18.1: convolution: avoid using unsigned accumulators [nakrovati] exif: check ifdN range [trailofbits] tiffload: check jpeg and jp2k components [wooseokdotkim] uhdrsave: set Q for gainmap recompress, don't chroma subsample RGB gainmaps uhdrsave: prevent early unref of image with alpha channel [lovell] rad2float: limit band count when converting from radiance [lovell] jxlload: check EXIF buffer size before reading header [lovell]",
    "products": [
      {
        "name": {
          "value": "libvips",
          "evidence": "Release notes from libvips"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v8.18.2",
            "evidence": "v8.18.2"
          }
        ],
        "affected_versions": [
          {
            "value": "8.18.1",
            "evidence": "Changes since 8.18.1:"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-libvips-libvips",
  "document_id": 21677,
  "published_at": "2026-04-01T11:41:02+00:00"
}