CVE-2026-33328 - Vulnerability Details - OpenCVE

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Libvips	Libvips

No data.

No data.

References

Link	Providers
https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969
https://github.com/libvips/libvips/pull/4935
https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7

History

Tue, 21 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 20 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Libvips Libvips libvips
Vendors & Products		Libvips Libvips libvips

Mon, 20 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.
Title		Possible integer overflow on 32-bit systems when reading GIF images
Weaknesses		CWE-190
References		https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969 https://github.com/libvips/libvips/pull/4935 https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7
Metrics		cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-20T16:22:22.378Z

Updated: 2026-07-21T15:58:57.209Z

Reserved: 2026-03-18T21:23:36.678Z

Link: CVE-2026-33328

Vulnrichment

Updated: 2026-07-21T15:57:18.927Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33328", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T21:23:36.678Z", "datePublished": "2026-07-20T16:22:22.378Z", "dateUpdated": "2026-07-21T15:58:57.209Z"}, "containers": {"cna": {"title": "Possible integer overflow on 32-bit systems when reading GIF images", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7"}, {"name": "https://github.com/libvips/libvips/pull/4935", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/pull/4935"}, {"name": "https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969"}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"version": "<= 8.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:22:22.378Z"}, "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1."}], "source": {"advisory": "GHSA-r98w-4fp7-m9c7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T15:53:55.236535Z", "id": "CVE-2026-33328", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T15:58:57.209Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Possible integer overflow on 32-bit systems when reading GIF images", "source": {"advisory": "GHSA-r98w-4fp7-m9c7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "<= 8.18.0"}]}], "references": [{"url": "https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7", "name": "https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libvips/libvips/pull/4935", "name": "https://github.com/libvips/libvips/pull/4935", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969", "name": "https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:22:22.378Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T15:53:55.236535Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-21T15:57:18.927Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-33328", "state": "PUBLISHED", "dateUpdated": "2026-07-20T16:22:22.378Z", "dateReserved": "2026-03-18T21:23:36.678Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T16:22:22.378Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}