CVE-2026-70651
Published: August 20th, 2026
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.
Unknown
CVSS v2:
CVSS v2:
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | libtiff (4.6.0) | Needs Triage | ||
| 26.2 | libtiff (4.6.0) | Needs Triage | ||
| 26.1 | libtiff (4.6.0) | Needs Triage | ||
| 25.4 | libtiff (4.6.0) | Needs Triage | ||
| 25.3 | libtiff (4.6.0) | Needs Triage | ||
| 25.2 | libtiff (4.6.0) | Needs Triage | ||
| 25.1 | libtiff (4.6.0) | Needs Triage | ||
| 24.4 | libtiff (4.6.0) | Needs Triage | ||
| 24.4.0 | libtiff (4.6.0) | Needs Triage | ||
| 24.3 | libtiff (4.6.0) | Needs Triage | ||
| 24.2 | libtiff (4.6.0) | Needs Triage | ||
| 24.1 | libtiff (4.6.0) | Needs Triage | ||
| 23.3 | libtiff (4.5.1) | Needs Triage | ||
| 23.2 | libtiff (4.3.0) | Needs Triage | ||
| 23.1 | libtiff (4.3.0) | Needs Triage | ||
| 22.4 | libtiff (4.3.0) | Needs Triage | ||
| 22.3 | libtiff (4.3.0) | Needs Triage | ||
| 22.2 | libtiff (4.3.0) | Needs Triage | ||
| 22.1 | libtiff (4.0.8) | Needs Triage | ||
| 21.11 | libtiff (4.0.8) | Needs Triage | ||
| 21.8 | libtiff (4.0.8) | Needs Triage | ||
| 21.5.0 | libtiff (4.0.8) | Needs Triage | ||
| 21.2.0 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.19.3667 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.18.3599 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.16.3445 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.15.3368 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.14.3263 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.13.3179 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.12.3054 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.11.3040 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.11.2990 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.10.2934 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.9.2878 | libtiff (4.0.8) | Needs Triage | ||
| 11.4.8.2822 | libtiff (4.0.8) | Needs Triage |