CVE-2026-35591 — Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number…
Published: 2026-07-20 · CVSS: 7.0 · CVSS 4.0
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7