DEBIAN-CVE-2026-35590
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-35590
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-35590.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-35590
- Upstream
- Published
- 2026-07-20T17:17:07Z
- Modified
- 2026-09-01T16:06:40Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
- References
Affected packages
Debian:12 / vips
Package
- Name
- vips
- Purl
- pkg:deb/debian/vips?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
8.*
8.14.1-3
8.14.1-3+deb12u1
8.14.1-3+deb12u2
8.14.1-3+deb12u3
8.14.2-1
8.14.3-1
8.14.4-1
8.14.5-1
8.15.0~rc2-1
8.15.0~rc2-2
8.15.0-1
8.15.0-2
8.15.1-1
8.15.1-1.1~exp1
8.15.1-1.1
8.15.2-1
8.15.2-2
8.15.3-1
8.16.0-1
8.16.0-2
8.16.1-1
8.16.1-2
8.17.3-1
8.17.3-2
8.18.0-1
8.18.0-2
8.18.0-3
8.18.1-1
8.18.2-1
8.18.3-1
8.18.4-1
8.18.5-1
8.18.6-1
Debian:13 / vips
Package
- Name
- vips
- Purl
- pkg:deb/debian/vips?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / vips
Package
- Name
- vips
- Purl
- pkg:deb/debian/vips?arch=source&distro=forky