{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70651", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-04T21:48:08.612Z", "datePublished": "2026-08-20T21:05:38.765Z", "dateUpdated": "2026-08-25T15:25:19.181Z"}, "containers": {"cna": {"title": "libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick", "problemTypes": [{"descriptions": [{"cweId": "CWE-680", "lang": "en", "description": "CWE-680: Integer Overflow to Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4"}, {"name": "https://github.com/libvips/libvips/pull/5040", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/pull/5040"}, {"name": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11"}, {"name": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3"}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"version": "< 8.18.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:05:38.765Z"}, "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3."}], "source": {"advisory": "GHSA-7p29-wg2h-36q4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T15:25:00.770734Z", "id": "CVE-2026-70651", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:25:19.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70651", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:25:00.770734Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:25:14.776Z"}}], "cna": {"title": "libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick", "source": {"advisory": "GHSA-7p29-wg2h-36q4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "libvips", "product": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}], "references": [{"url": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4", "name": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libvips/libvips/pull/5040", "name": "https://github.com/libvips/libvips/pull/5040", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11", "name": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "name": "https://github.com/libvips/libvips/releases/tag/v8.18.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-680", "description": "CWE-680: Integer Overflow to Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:05:38.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70651", "state": "PUBLISHED", "dateUpdated": "2026-08-25T15:25:19.181Z", "dateReserved": "2026-08-04T21:48:08.612Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:05:38.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libvips", "vendor": "libvips", "versions": [{"status": "affected", "version": "< 8.18.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3."}], "id": "CVE-2026-70651", "lastModified": "2026-08-25T16:17:08.270", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70651", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T15:25:00.770734Z", "version": "2.0.3"}}]}, "published": "2026-08-20T21:17:08.120", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/pull/5040"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/releases/tag/v8.18.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-680"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libvips: libvips: Denial of Service via integer overflow in multi-page TIFF image processing", "id": "2520803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520803"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.", "A flaw was found in libvips, an image processing library. When libvips is built without libtiff support but with ImageMagick support, an integer overflow can occur while loading a crafted multi-page Tagged Image File Format (TIFF) image. This overflow, caused by unchecked calculations of image frame height, can lead to a heap buffer over-read and result in a process crash, causing a Denial of Service (DoS)."], "name": "CVE-2026-70651", "public_date": "2026-08-20T21:05:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-70651\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-70651\nhttps://github.com/libvips/libvips/commit/05719ca3d5852acdeb6714de2e8e769c9a5d2c11\nhttps://github.com/libvips/libvips/pull/5040\nhttps://github.com/libvips/libvips/releases/tag/v8.18.3\nhttps://github.com/libvips/libvips/security/advisories/GHSA-7p29-wg2h-36q4"], "statement": "This Moderate impact flaw in libvips occurs when the library is built without libtiff support but with ImageMagick, allowing a local attacker to trigger a denial of service by providing a crafted multi-page TIFF image. Most Red Hat package builds include libtiff, which prevents the vulnerable fallback path, thereby limiting exposure in typical installations.", "threat_severity": "Moderate"}