# libvips.

Every CVE that names libvips among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow](https://agentprime.io/advisories/CVE-2026-70654.md)
  `CVE-2026-70654` · CVE record: libvips libvips · CVSS 5.8 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image](https://agentprime.io/advisories/CVE-2026-70653.md)
  `CVE-2026-70653` · CVE record: libvips libvips · CVSS 4.8 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick](https://agentprime.io/advisories/CVE-2026-70651.md)
  `CVE-2026-70651` · CVE record: libvips libvips · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map](https://agentprime.io/advisories/CVE-2026-70652.md)
  `CVE-2026-70652` · CVE record: libvips libvips · CVSS 2.0 Low · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-126
- [libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write](https://agentprime.io/advisories/CVE-2026-69242.md)
  `CVE-2026-69242` · CVE record: libvips libvips · CVSS 8.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile](https://agentprime.io/advisories/CVE-2026-35591.md)
  `CVE-2026-35591` · CVE record: libvips libvips · CVSS 7.0 High · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption
- [Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata](https://agentprime.io/advisories/CVE-2026-35590.md)
  `CVE-2026-35590` · CVE record: libvips libvips · CVSS 6.8 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption
- [Possible integer overflow on 32-bit systems when reading GIF images](https://agentprime.io/advisories/CVE-2026-33328.md)
  `CVE-2026-33328` · CVE record: libvips libvips · CVSS 6.8 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption
- [Possible integer overflow leading to potential heap-based buffer overflow](https://agentprime.io/advisories/CVE-2026-33327.md)
  `CVE-2026-33327` · CVE record: libvips libvips · CVSS 7.0 High · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption
- [libvips nip2 vips7compat.c im_minpos_vec heap-based overflow](https://agentprime.io/advisories/CVE-2026-6491.md)
  `CVE-2026-6491` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Memory corruption
- [libvips extract.c vips_extract_area_build integer overflow](https://agentprime.io/advisories/CVE-2026-3284.md)
  `CVE-2026-3284` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Memory corruption, CWE-189
- [libvips extract.c vips_extract_band_build out-of-bounds](https://agentprime.io/advisories/CVE-2026-3283.md)
  `CVE-2026-3283` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Memory corruption
- [libvips unpremultiply.c vips_unpremultiply_build out-of-bounds](https://agentprime.io/advisories/CVE-2026-3282.md)
  `CVE-2026-3282` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Memory corruption
- [libvips bandrank.c vips_bandrank_build heap-based overflow](https://agentprime.io/advisories/CVE-2026-3281.md)
  `CVE-2026-3281` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Memory corruption
- [libvips csvload.c vips_foreign_load_csv_build heap-based overflow](https://agentprime.io/advisories/CVE-2026-3147.md)
  `CVE-2026-3147` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption
- [libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference](https://agentprime.io/advisories/CVE-2026-3146.md)
  `CVE-2026-3146` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Denial of service, Memory corruption
- [libvips matrixload.c vips_foreign_load_matrix_header memory corruption](https://agentprime.io/advisories/CVE-2026-3145.md)
  `CVE-2026-3145` · CVE record: libvips · CVSS 4.8 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption
- [libvips source.c vips_source_read_to_memory heap-based overflow](https://agentprime.io/advisories/CVE-2026-2913.md)
  `CVE-2026-2913` · CVE record: libvips · CVSS 2.0 Low · Not analysed yet · Published 22 Feb 2026 · Tags: Memory corruption
- [libvips is vulnerable to Buffer Over-Read in poppler-based pdfload](https://agentprime.io/advisories/CVE-2025-59933.md)
  `CVE-2025-59933` · CVE record: libvips libvips · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-126
- [libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output](https://agentprime.io/advisories/CVE-2025-29769.md)
  `CVE-2025-29769` · CVE record: libvips libvips · CVSS 8.5 High · Not analysed yet · Published 7 Apr 2025 · Tags: Memory corruption
- [Potential segfault due to NULL pointer dereference in libvips](https://agentprime.io/advisories/CVE-2023-40032.md)
  `CVE-2023-40032` · CVE record: libvips libvips · CVSS 5.5 Medium · Not analysed yet · Published 11 Sept 2023 · Tags: Memory corruption

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=libvips>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/libvips/>. Everything for agents: <https://agentprime.io/llms.txt>.