CVE-2026-35591
Description
libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.
How to fix CVE-2026-35591
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- Debian/vips—no fix listed
Is CVE-2026-35591 being exploited?
No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2026-35591.
Affected packages (1)
- from 0