CVE catalog

CVE-2026-88360

libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel da

[CVE catalog]

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Sep 24, 2026, 12:00:00 AM UTC
Updated: Sep 24, 2026, 2:18:18 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.32% · Oct 25, 2026

A flaw was found in libvips, an image processing library. When handling specially crafted little-endian PFM (Portable Float Map) images, an attacker could trigger an unaligned memory access. This occurs if the image's text header length is not a multiple of four bytes, causing the loader to expose pixel data at an incorrect memory address. Such unaligned access can lead to undefined behavior and cause the application to terminate, resulting in a denial of service (DoS) for affected systems. This vulnerability is rated as Moderate impact because successful exploitation requires user interaction to process an untrusted, malformed image file and is restricted to causing an application crash without compromising confidentiality or integrity. In typical Red Hat deployments, libvips is utilized as a shared library for image manipulation pipelines, meaning the failure is confined to the specific consuming process or task. Furthermore, abnormal termination from unaligned pointer dereferencing primarily manifests on architectures enforcing strict memory alignment or under specific build instrumentation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	vips	bookworm	Not reported	vulnerable
Debian	vips	12	`8.14.1-3`	vulnerable
Debian	vips	12	`8.14.1-3+deb12u1`	vulnerable
Debian	vips	12	`8.14.1-3+deb12u2`	vulnerable
Debian	vips	12	`8.14.1-3+deb12u3`	vulnerable
Debian	vips	12	`8.14.2-1`	vulnerable
Debian	vips	12	`8.14.3-1`	vulnerable
Debian	vips	12	`8.14.4-1`	vulnerable
Debian	vips	12	`8.14.5-1`	vulnerable
Debian	vips	12	`8.15.0-1`	vulnerable
Debian	vips	12	`8.15.0-2`	vulnerable
Debian	vips	12	`8.15.0~rc2-1`	vulnerable
Debian	vips	12	`8.15.0~rc2-2`	vulnerable
Debian	vips	12	`8.15.1-1`	vulnerable
Debian	vips	12	`8.15.1-1.1`	vulnerable
Debian	vips	12	`8.15.1-1.1~exp1`	vulnerable
Debian	vips	12	`8.15.2-1`	vulnerable
Debian	vips	12	`8.15.2-2`	vulnerable
Debian	vips	12	`8.15.3-1`	vulnerable
Debian	vips	12	`8.16.0-1`	vulnerable
Debian	vips	12	`8.16.0-2`	vulnerable
Debian	vips	12	`8.16.1-1`	vulnerable
Debian	vips	12	`8.16.1-2`	vulnerable
Debian	vips	12	`8.17.3-1`	vulnerable
Debian	vips	12	`8.17.3-2`	vulnerable
Debian	vips	12	`8.18.0-1`	vulnerable
Debian	vips	12	`8.18.0-2`	vulnerable
Debian	vips	12	`8.18.0-3`	vulnerable
Debian	vips	12	`8.18.1-1`	vulnerable
Debian	vips	12	`8.18.2-1`	vulnerable
Debian	vips	12	`8.18.3-1`	vulnerable
Debian	vips	12	`8.18.4-1`	vulnerable
Debian	vips	12	`8.18.5-1`	vulnerable
Debian	vips	12	`8.18.6-1`	vulnerable
Debian	vips	12	`8.18.6-2`	vulnerable
Debian	vips	13	`8.16.1-1`	vulnerable
Debian	vips	13	`8.16.1-1+deb13u1`	vulnerable
Debian	vips	13	`8.16.1-2`	vulnerable
Debian	vips	13	`8.17.3-1`	vulnerable
Debian	vips	13	`8.17.3-2`	vulnerable
Debian	vips	13	`8.18.0-1`	vulnerable
Debian	vips	13	`8.18.0-2`	vulnerable
Debian	vips	13	`8.18.0-3`	vulnerable
Debian	vips	13	`8.18.1-1`	vulnerable
Debian	vips	13	`8.18.2-1`	vulnerable
Debian	vips	13	`8.18.3-1`	vulnerable
Debian	vips	13	`8.18.4-1`	vulnerable
Debian	vips	13	`8.18.5-1`	vulnerable
Debian	vips	13	`8.18.6-1`	vulnerable
Debian	vips	13	`8.18.6-2`	vulnerable
Debian	vips	14	`8.16.1-1`	vulnerable
Debian	vips	14	`8.16.1-2`	vulnerable
Debian	vips	14	`8.17.3-1`	vulnerable
Debian	vips	14	`8.17.3-2`	vulnerable
Debian	vips	14	`8.18.0-1`	vulnerable
Debian	vips	14	`8.18.0-2`	vulnerable
Debian	vips	14	`8.18.0-3`	vulnerable
Debian	vips	14	`8.18.1-1`	vulnerable
Debian	vips	14	`8.18.2-1`	vulnerable
Debian	vips	14	`8.18.3-1`	vulnerable
Debian	vips	14	`8.18.4-1`	vulnerable
Debian	vips	14	`8.18.5-1`	vulnerable
Debian	vips	14	`8.18.6-1`	vulnerable
Debian	vips	14	`8.18.6-2`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-vips-8.0]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips42]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips-dev]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips-doc]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · all · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · all · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · all · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · all · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
[libvips-tools]Affected
Source package: [vips]
Details (4)
- 8.14.1-3+deb12u3 · amd64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u3 · arm64 · bookworm
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · amd64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12
- 8.14.1-3+deb12u2 · arm64 · bookworm-security
  Affected
  nvd · vips · debian · bookworm; nvd · vips · debian · 12

[Debian 13 (Trixie)]

[gir1.2-vips-8.0]Affected
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Affected
  nvd · vips · debian · 13
[libvips42t64]Affected
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Affected
  nvd · vips · debian · 13
[libvips-dev]Affected
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Affected
  nvd · vips · debian · 13
[libvips-doc]Affected
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · all · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · all · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · all · trixie-security
  Affected
  nvd · vips · debian · 13
[libvips-tools]Affected
Source package: [vips]
Details (3)
- 8.16.1-1+deb13u1 · amd64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u1 · arm64 · trixie
  Affected
  nvd · vips · debian · 13
- 8.16.1-1+deb13u2 · amd64 · trixie-security
  Affected
  nvd · vips · debian · 13

Observed: Oct 27, 2026, 5:24:25 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]