CVE-2026-6491

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Apr 17, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-649107.8Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-649117.8Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-649127.8Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2026-649147.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2026-649157.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-649165.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-649175.5Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-649186.5Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.CVE-2026-649197.8Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2026-64925.3A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted elemenCVE-2026-649207.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2026-649218.8Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a netwo
CVE-2026-6491: Medium severity, CVSS 5.3 | Vulnix