CVE-2026-35590 libvips CVE debrief

Who should care

Users of libvips versions before 8.18.2 should be aware of this vulnerability and take steps to mitigate it. This includes verifying libvips installations and applying patch version 8.18.2 or later. Security teams and operators using libvips should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The EXIF decoder in libvips versions before and including 8.18.1 does not verify the range of EXIF tag groups before passing data to libexif, which can lead to a null pointer dereference and crash. This issue has been patched in version 8.18.2. Users of libvips should ensure they are using version 8.18.2 or later to mitigate this vulnerability. Affected users should verify their libvips installations and ensure version 8.18.2 or later is in use. Security teams and operators using libvips should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Medium priority due to the potential for crash and possibility of remote exploitation. Security teams should prioritize verification of libvips installations and application of the patch.

Recommended defensive actions

• Inventory libvips installations and verify version 8.18.2 or later is in use.
• Apply patch version 8.18.2 or later.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and testing may be necessary to fully understand the impact of this vulnerability. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, which could lead to a possible null pointer dereference and crash. Affected users should verify their libvips installations and ensure version 8.18.2 or later is in use. Additional details may be found in the official CVE record and NVD entry.

Official resources