CVE-2026-6491

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6491", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-17T07:21:38.455Z", "datePublished": "2026-04-17T13:45:11.506Z", "dateUpdated": "2026-04-18T02:59:14.319Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-17T13:45:11.506Z"}, "title": "libvips nip2 vips7compat.c im_minpos_vec heap-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-122", "lang": "en", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "libvips", "versions": [{"version": "8.18.0", "status": "affected"}, {"version": "8.18.1", "status": "affected"}, {"version": "8.18.2", "status": "affected"}], "cpes": ["cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*"], "modules": ["nip2 Handler"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will \"be removing the deprecated area in libvips 8.19\"."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:T/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:T/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:TF/RC:C"}}], "timeline": [{"time": "2026-04-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-17T09:27:18.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "biniam (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/358035", "name": "VDB-358035 | libvips nip2 vips7compat.c im_minpos_vec heap-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358035/cti", "name": "VDB-358035 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/786994", "name": "Submit #786994 | libvips 8.19.0 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/libvips/libvips/issues/4965", "tags": ["issue-tracking"]}, {"url": "https://github.com/libvips/libvips/issues/4965#issuecomment-4135003499", "tags": ["issue-tracking"]}, {"url": "https://github.com/biniamf/pocs/tree/main/libvips_im_minpos_vec_oob", "tags": ["exploit"]}, {"url": "https://github.com/libvips/libvips/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-18T02:59:05.291556Z", "id": "CVE-2026-6491", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-18T02:59:14.319Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6491", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-18T02:59:05.291556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-18T02:59:10.753Z"}}], "cna": {"title": "libvips nip2 vips7compat.c im_minpos_vec heap-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "biniam (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:T/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:T/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:TF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["nip2 Handler"], "product": "libvips", "versions": [{"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.18.1"}, {"status": "affected", "version": "8.18.2"}]}], "timeline": [{"lang": "en", "time": "2026-04-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-17T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-17T09:27:18.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/358035", "name": "VDB-358035 | libvips nip2 vips7compat.c im_minpos_vec heap-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358035/cti", "name": "VDB-358035 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/786994", "name": "Submit #786994 | libvips 8.19.0 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/libvips/libvips/issues/4965", "tags": ["issue-tracking"]}, {"url": "https://github.com/libvips/libvips/issues/4965#issuecomment-4135003499", "tags": ["issue-tracking"]}, {"url": "https://github.com/biniamf/pocs/tree/main/libvips_im_minpos_vec_oob", "tags": ["exploit"]}, {"url": "https://github.com/libvips/libvips/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will \"be removing the deprecated area in libvips 8.19\"."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-17T13:45:11.506Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6491", "state": "PUBLISHED", "dateUpdated": "2026-04-18T02:59:14.319Z", "dateReserved": "2026-04-17T07:21:38.455Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-17T13:45:11.506Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*"], "modules": ["nip2 Handler"], "product": "libvips", "vendor": "n/a", "versions": [{"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.18.1"}, {"status": "affected", "version": "8.18.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will \"be removing the deprecated area in libvips 8.19\"."}], "id": "CVE-2026-6491", "lastModified": "2026-06-17T11:00:52.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6491", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-18T02:59:05.291556Z", "version": "2.0.3"}}]}, "published": "2026-04-17T14:16:35.187", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/biniamf/pocs/tree/main/libvips_im_minpos_vec_oob"}, {"source": "cna@vuldb.com", "url": "https://github.com/libvips/libvips/"}, {"source": "cna@vuldb.com", "url": "https://github.com/libvips/libvips/issues/4965"}, {"source": "cna@vuldb.com", "url": "https://github.com/libvips/libvips/issues/4965#issuecomment-4135003499"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/786994"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358035"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358035/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-122"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.18.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.18.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.18.2"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "libvips", "source": "cna", "vendor": "n/a"}, "product": "libvips", "vendor": "libvips"}], "analysis": {"en": {"generated_at": "2026-04-18T20:05:01.739775+00:00", "value": {"mitigation_remediation": ["Upgrade libvips to version 8.19 or later, where the deprecated nip2 functionality is removed.", "If an immediate upgrade is not possible, disable or remove the nip2 handler or alternate code paths that invoke im_minpos_vec to eliminate the vulnerable function.", "Monitor local processes that utilize libvips for abnormal crashes or signs of heap corruption, and restrict execution of those processes to trusted users only."], "summary": {"action": "Patch", "impact": "Heap-based buffer overflow with local exploitation potential"}, "threat_synthesis": {"affected_systems": "Versions of libvips up to and including 8.18.2 are affected. The vulnerability resides in the deprecated nip2 handler. A newer release (8.19) will remove the deprecated code path, removing the vulnerability.", "description_and_impact": "A heap-based buffer overflow occurs in the function im_minpos_vec located in libvips/deprecated/vips7compat.c. An attacker who can influence the argument n can cause the function to write past the bounds of a dynamically allocated buffer, potentially corrupting adjacent heap objects. The vulnerability is limited to local use, but local corruption can lead to application crashes or may lead to arbitrary code execution under certain conditions. Based on the description, it is inferred that arbitrary code execution could be achieved if the heap overwrite is leveraged properly, though the vulnerability statement itself does not explicitly confirm this capability.", "risk_and_exploitability": "The CVSS score of 4.8 places the vulnerability in the moderate range. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation at the time. Because an attacker must have local access to the system running libvips, the risk is primarily to environments where untrusted users can invoke libvips; however, local exploitation can still lead to service disruption or may allow privilege escalation if the heap overwrite is leveraged carefully."}}}}, "created": "2026-04-17T15:30:05.881223+00:00", "updated": "2026-04-18T20:15:09.540115+00:00", "vendors": ["libvips", "libvips$PRODUCT$libvips"]}