CVE-2026-70651

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70651", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-04T21:48:08.612Z", "datePublished": "2026-08-20T21:05:38.765Z", "dateUpdated": "2026-08-25T15:25:19.181Z"}, "containers": {"cna": {"title": "libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick", "problemTypes": [{"descriptions": [{"cweId": "CWE-680", "lang": "en", "description": "CWE-680: Integer Overflow to Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4"}, {"name": "https://github.com/libvips/libvips/pull/5040", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/pull/5040"}, {"name": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11"}, {"name": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3"}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"version": "< 8.18.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:05:38.765Z"}, "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3."}], "source": {"advisory": "GHSA-7p29-wg2h-36q4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T15:25:00.770734Z", "id": "CVE-2026-70651", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:25:19.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70651", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:25:00.770734Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:25:14.776Z"}}], "cna": {"title": "libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick", "source": {"advisory": "GHSA-7p29-wg2h-36q4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}], "references": [{"url": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4", "name": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libvips/libvips/pull/5040", "name": "https://github.com/libvips/libvips/pull/5040", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11", "name": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "name": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-680", "description": "CWE-680: Integer Overflow to Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:05:38.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70651", "state": "PUBLISHED", "dateUpdated": "2026-08-25T15:25:19.181Z", "dateReserved": "2026-08-04T21:48:08.612Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:05:38.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libvips", "vendor": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3."}, {"lang": "es", "value": "libvips es una biblioteca de procesamiento de im\u00e1genes r\u00e1pida con bajas necesidades de memoria. Antes de la versi\u00f3n 8.18.3, libvips compilado sin soporte para libtiff pero con soporte para ImageMagick puede desbordar la altura de fotograma combinada al cargar un TIFF multip\u00e1gina manipulado a trav\u00e9s de VipsForeignLoadMagick. Los c\u00e1lculos vulnerables en libvips/foreign/magick6load.c y libvips/foreign/magick7load.c multiplican el Ysize por p\u00e1gina por n_frames sin un l\u00edmite comprobado, lo que puede causar una lectura excesiva del b\u00fafer de pila y un fallo del proceso. La mayor\u00eda de las compilaciones de gestores de paquetes incluyen libtiff y no utilizan esta ruta de respaldo afectada. Este problema est\u00e1 corregido en la versi\u00f3n 8.18.3."}], "id": "CVE-2026-70651", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70651", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T15:25:00.770734Z", "version": "2.0.3"}}]}, "published": "2026-08-20T21:17:08.120", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/pull/5040"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-680"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libvips: libvips: Denial of Service via integer overflow in multi-page TIFF image processing", "id": "2520803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520803"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.", "A flaw was found in libvips, an image processing library. When libvips is built without libtiff support but with ImageMagick support, an integer overflow can occur while loading a crafted multi-page Tagged Image File Format (TIFF) image. This overflow, caused by unchecked calculations of image frame height, can lead to a heap buffer over-read and result in a process crash, causing a Denial of Service (DoS)."], "name": "CVE-2026-70651", "public_date": "2026-08-20T21:05:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-70651\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-70651\nhttps://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11\nhttps://github.com/libvips/libvips/pull/5040\nhttps://github.com/libvips/libvips/releases/tag/v8.18.3\nhttps://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4"], "statement": "This Moderate impact flaw in libvips occurs when the library is built without libtiff support but with ImageMagick, allowing a local attacker to trigger a denial of service by providing a crafted multi-page TIFF image. Most Red Hat package builds include libtiff, which prevents the vulnerable fallback path, thereby limiting exposure in typical installations.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.18.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libvips", "source": "cna", "vendor": "libvips"}, "product": "libvips", "vendor": "libvips"}], "created": "2026-08-20T22:45:02.858536+00:00", "updated": "2026-08-31T15:00:07.576509+00:00", "vendors": ["libvips", "libvips$PRODUCT$libvips"]}