Ubuntu USN-8994-1 fixes nine libvips vulnerabilities in image processing
- Severity
- High
- Sources
- 1
What happened
USN-8994-1 covers nine libvips flaws: CVE-2025-59933 (PDF page with width but no height), CVE-2026-33327 (vipsload integer overflow), CVE-2026-33328 (gifload integer overflow on 32-bit), CVE-2026-35590 (EXIF tag group validation), CVE-2026-35591 (TIFF tile channel count), CVE-2026-69242 (TIFF scanline overflow with many bands), CVE-2026-70651 (multi-page TIFF frame heights via ImageMagick), CVE-2026-70653 (Radiance information disclosure), and CVE-2026-70654 (PPM read sizes from custom sources). Several are DoS-only, while CVE-2025-59933, CVE-2026-33327, CVE-2026-35591, CVE-2026-69242 and CVE-2026-70654 may also allow code execution. Apply the libvips updates for your Ubuntu release, noting that the affected releases vary by CVE.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Apply the libvips package updates for your Ubuntu release as described in USN-8994-1.
- Prioritise hosts that process untrusted PDF, TIFF, GIF, PPM or EXIF images with libvips.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products