CVE catalog

CVE-2026-2913

Severity: Low · CVSS 2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Feb 22, 2026, 4:02:13 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.21% · Oct 25, 2026

A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	vips	sid	`8.18.7-1`	fixed
Debian	vips	forky	`8.18.7-1`	fixed
Debian	vips	trixie	`8.16.1-1+deb13u1`	fixed
Debian	vips	trixie-security	`8.16.1-1+deb13u2`	fixed
Debian	vips	bookworm	`8.14.1-3+deb12u3`	fixed
Debian	vips	bookworm-security	`8.14.1-3+deb12u2`	vulnerable
Cpe	vips	Not reported	Not reported	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	vips	source	sid	`8.18.0-2`	not yet assigned	Not reported	[1128785]
Debian	vips	source	forky	`8.18.0-2`	not yet assigned	Not reported	[1128785]
Debian	vips	source	trixie	`8.16.1-1+deb13u1`	not yet assigned	Not reported	[1128785]
Debian	vips	source	bookworm	`8.14.1-3+deb12u3`	not yet assigned	Not reported	[1128785]

[Debian bug #1128785]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-vips-8.0]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips42]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips-dev]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips-doc]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · all · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · all · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · all · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · all · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips-tools]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 8.14.1-3+deb12u3
  nvd · vips · debian · bookworm; nvd · vips · debian · 12

[Debian 13 (Trixie)]

[gir1.2-vips-8.0]Fixed
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
[libvips42t64]Fixed
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
[libvips-dev]Fixed
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
[libvips-doc]Fixed
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · all · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · all · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · all · trixie-security
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
[libvips-tools]Fixed
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 8.16.1-1+deb13u1
  nvd · vips · debian · 13

Observed: Oct 27, 2026, 9:31:49 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]