CVE-2026-33328

MediumCVSS 5.5/10Last modified Aug 19, 2026

Description

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
libvips	libvips	<= 8.18.0

References

https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969Patch
https://github.com/libvips/libvips/pull/4935Issue Tracking, Patch
https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7Vendor Advisory, Mitigation

Timeline

Published: Jul 20, 2026
Last modified: Aug 19, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-333298.1FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter i CVE-2026-33336.4The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all ver CVE-2026-333307.1FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE CVE-2026-333315.4oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross CVE-2026-333327.5NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept CVE-2026-333333.5Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. Thi CVE-2026-333349.6Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop E CVE-2026-333358.0Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop E CVE-2026-333368.8Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop E CVE-2026-333377.5Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice p CVE-2026-33348.8The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' para CVE-2026-333409.1LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSR