Medium
vips — security advisory
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
- Products
- vips
- Affected versions
- 7.40.6-2ubuntu2, 8.0.2-2, 8.10.5-2ubuntu1, 8.11.4-2, 8.12.1-1, 8.12.1-1build1, 8.12.1-1ubuntu0.1~esm1, 8.12.1-1ubuntu0.1~esm2, 8.14.3-1, 8.14.5-1, 8.15.0-1, 8.15.0-2, 8.15.1-1, 8.15.1-1.1build3, 8.15.1-1.1build4, 8.15.1-1.1ubuntu0.1~esm1, 8.15.1-1build1, 8.16.1-1, 8.16.1-2, 8.17.3-2, 8.18.0-1, 8.18.0-1build1, 8.18.0-1ubuntu0.1~esm1, 8.2.1-1, 8.2.2-1, 8.2.2-1ubuntu0.1~esm1, 8.4.5-1build1, 8.4.5-1ubuntu0.1~esm1, 8.7.4-1build1, 8.8.3-3, 8.8.3-3ubuntu1, 8.9.0-1, 8.9.0-1build1, 8.9.1-1, 8.9.1-2, 8.9.1-2ubuntu0.1~esm1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-35590
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 10:18 UTC · Revision 1
Source evidence
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
osv:UBUNTU-CVE-2026-35590
vips
Fixed versions: Not specified
vips
Fixed versions: Not specified
vips
Fixed versions: Not specified
vips
Fixed versions: Not specified
vips
Fixed versions: Not specified
vips
Fixed versions: Not specified
Complete source record
{
"id": "7e6e5ee2f2b884416c80a5b67ed408ca3b49007f08b6ee7f7f07d31e6b75024d",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-35590",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-35590",
"summary": "libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.",
"evidence": "osv:UBUNTU-CVE-2026-35590",
"products": [
{
"name": {
"value": "vips",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.40.6-2ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.2-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.2-1ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "vips",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.4.5-1build1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.5-1ubuntu0.1~esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "vips",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.7.4-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "8.8.3-3",
"evidence": "/affected/2/versions"
},
{
"value": "8.8.3-3ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "8.9.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.9.0-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "8.9.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.9.1-2",
"evidence": "/affected/2/versions"
},
{
"value": "8.9.1-2ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "vips",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.10.5-2ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "8.11.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "8.12.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "8.12.1-1build1",
"evidence": "/affected/3/versions"
},
{
"value": "8.12.1-1ubuntu0.1~esm1",
"evidence": "/affected/3/versions"
},
{
"value": "8.12.1-1ubuntu0.1~esm2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "vips",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.14.3-1",
"evidence": "/affected/4/versions"
},
{
"value": "8.14.5-1",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.0-2",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.1-1",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.1-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.1-1.1build3",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.1-1.1build4",
"evidence": "/affected/4/versions"
},
{
"value": "8.15.1-1.1ubuntu0.1~esm1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "vips",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.16.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "8.16.1-2",
"evidence": "/affected/5/versions"
},
{
"value": "8.17.3-2",
"evidence": "/affected/5/versions"
},
{
"value": "8.18.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "8.18.0-1build1",
"evidence": "/affected/5/versions"
},
{
"value": "8.18.0-1ubuntu0.1~esm1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-35590",
"aliases": [
"UBUNTU-CVE-2026-35590"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/ubuntu/vips?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"7.40.6-2ubuntu2",
"8.0.2-2",
"8.2.1-1",
"8.2.2-1",
"8.2.2-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35590.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-vips-8.0",
"binary_version": "8.2.2-1ubuntu0.1~esm1"
},
{
"binary_name": "libvips-tools",
"binary_version": "8.2.2-1ubuntu0.1~esm1"
},
{
"binary_name": "libvips42",
"binary_version": "8.2.2-1ubuntu0.1~esm1"
},
{
"binary_name": "python-vipscc",
"binary_version": "8.2.2-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/ubuntu/vips?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"8.4.5-1build1",
"8.4.5-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35590.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-vips-8.0",
"binary_version": "8.4.5-1ubuntu0.1~esm1"
},
{
"binary_name": "libvips-tools",
"binary_version": "8.4.5-1ubuntu0.1~esm1"
},
{
"binary_name": "libvips42",
"binary_version": "8.4.5-1ubuntu0.1~esm1"
},
{
"binary_name": "python-vipscc",
"binary_version": "8.4.5-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/ubuntu/vips?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"8.7.4-1build1",
"8.8.3-3",
"8.8.3-3ubuntu1",
"8.9.0-1",
"8.9.0-1build1",
"8.9.1-1",
"8.9.1-2",
"8.9.1-2ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35590.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-vips-8.0",
"binary_version": "8.9.1-2ubuntu0.1~esm1"
},
{
"binary_name": "libvips-tools",
"binary_version": "8.9.1-2ubuntu0.1~esm1"
},
{
"binary_name": "libvips42",
"binary_version": "8.9.1-2ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/ubuntu/vips?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"8.10.5-2ubuntu1",
"8.11.4-2",
"8.12.1-1",
"8.12.1-1build1",
"8.12.1-1ubuntu0.1~esm1",
"8.12.1-1ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35590.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-vips-8.0",
"binary_version": "8.12.1-1ubuntu0.1~esm2"
},
{
"binary_name": "libvips-tools",
"binary_version": "8.12.1-1ubuntu0.1~esm2"
},
{
"binary_name": "libvips42",
"binary_version": "8.12.1-1ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/ubuntu/vips?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"8.14.3-1",
"8.14.5-1",
"8.15.0-1",
"8.15.0-2",
"8.15.1-1",
"8.15.1-1build1",
"8.15.1-1.1build3",
"8.15.1-1.1build4",
"8.15.1-1.1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35590.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-vips-8.0",
"binary_version": "8.15.1-1.1ubuntu0.1~esm1"
},
{
"binary_name": "libvips-tools",
"binary_version": "8.15.1-1.1ubuntu0.1~esm1"
},
{
"binary_name": "libvips42t64",
"binary_version": "8.15.1-1.1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vips",
"purl": "pkg:deb/ubuntu/vips?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"8.16.1-1",
"8.16.1-2",
"8.17.3-2",
"8.18.0-1",
"8.18.0-1build1",
"8.18.0-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35590.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-vips-8.0",
"binary_version": "8.18.0-1ubuntu0.1~esm1"
},
{
"binary_name": "libvips-tools",
"binary_version": "8.18.0-1ubuntu0.1~esm1"
},
{
"binary_name": "libvips42t64",
"binary_version": "8.18.0-1ubuntu0.1~esm1"
}
]
}
}
],
"modified": "2026-10-25T18:00:02.972815190Z",
"provider": "osv",
"upstream": [
"CVE-2026-35590"
],
"references": [
"https://ubuntu.com/security/CVE-2026-35590",
"https://www.cve.org/CVERecord?id=CVE-2026-35590",
"https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm",
"https://github.com/libvips/libvips/pull/4972"
]
},
"related_cves": [
{
"value": "CVE-2026-35590",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 445768,
"published_at": "2026-07-20T17:17:00+00:00"
}