CVE-2026-70651

unknowncovered by 1 sourcefirst seen 2026-08-20

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magick6load.c and libvips/foreign/magick7load.c multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash. Most package-manager builds include libtiff and do not use this affected fallback path. This issue is fixed in version 8.18.3.

⚡ Watch CVE-2026-70651

Get an email if CVE-2026-70651 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-70651: libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, lib…nvd · 2026-08-20

External references

NVD record for CVE-2026-70651

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-70651 status](https://www.csirts.com/badge/CVE-2026-70651)](https://www.csirts.com/cve/CVE-2026-70651)