CVE-2026-70652 libvips CVE debrief

Who should care

Defenders responsible for image processing systems using libvips with libultrahdr support should assess exposure and verify if libvips is updated to version 8.18.3 or later. They should also prioritize verifying if their systems use libvips with libultrahdr support and assess exposure to potential buffer over-reads. Defenders should care about CVE-2026-70652 because it can lead to potential buffer over-reads and disclosure of adjacent data in libvips with

Why it matters

Defenders should care about CVE-2026-70652 because it can lead to potential buffer over-reads and disclosure of adjacent data in libvips with libultrahdr support. The issue is fixed in version 8.18.3, and defenders should verify if their systems are affected and prioritize updates.

• Potential disclosure of adjacent data
• Possible process crashes due to buffer over-reads
• Verification of libvips version and configuration is necessary
• Prioritization of updates to libvips version 8.18.3 or later

Technical summary

libvips built with libultrahdr support can incorrectly size an output buffer, leading to a heap buffer over-read that may disclose adjacent data or crash the process when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. This issue is fixed in version 8.18.3. Defenders should prioritize verifying if their systems use libvips with libultrahdr support and assess exposure to potential buffer over-reads. They should also verify if libvips is updated to version 8.18.3 or later.

Defensive priority

Defenders should prioritize verifying if their systems use libvips with libultrahdr support and assess exposure to potential buffer over-reads. They should also verify if libvips is updated to version 8.18.3 or later.

Recommended defensive actions

• Verify if libvips with libultrahdr support is used in the environment.
• Check if libvips is updated to version 8.18.3 or later.
• Monitor for potential buffer over-reads and crashes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in libvips. The issue is fixed in version 8.18.3. Defenders should verify if their systems are affected by checking the libvips version and configuration. They should also monitor for potential buffer over-reads and crashes. The vulnerability allows for a heap buffer over-read that may disclose adjacent data or crash the process when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.