CVE-2026-35591

libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.

• CWE-122

• https://github.com/libvips/libvips/commit/df044e409a0db77c980fa1a9f86a13fbfb2dc8fePatch
• https://github.com/libvips/libvips/pull/4973Issue Tracking, Patch
• https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76Vendor Advisory, Patch

Published

Jul 20, 2026

Last Modified

Aug 19, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35586pyLoad is a free and open-source download manager written in…6.8
• CVE-2026-35587Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-35588Glances is an open-source system cross-platform monitoring t…6.3
• CVE-2026-35589nanobot is a personal AI assistant. Versions prior to 0.1.5 …9.3
• CVE-2026-3559Philips Hue Bridge HomeKit Accessory Protocol Static Nonce A…8.1
• CVE-2026-35590libvips is a fast image processing library with low memory n…5.5
• CVE-2026-35592pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-35593Trilium Notes is an open-source, cross-platform hierarchical…6.8
• CVE-2026-35594Vikunja is an open-source self-hosted task management platfo…6.5
• CVE-2026-35595Vikunja is an open-source self-hosted task management platfo…8.3
• CVE-2026-35596Vikunja is an open-source self-hosted task management platfo…4.3
• CVE-2026-35597Vikunja is an open-source self-hosted task management platfo…7.5