CVE-2026-2913 libvips source.c vips_source_read_to_memory heap-based overflow
A heap-based buffer overflow in libvips allows local attackers to cause a denial of service via custom seekable sources larger than 4 GiB.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2913?
CVE-2026-2913 is a low-severity memory corruption vulnerability in libvips, published on 22 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."
Which versions are affected by CVE-2026-2913?
It affects 1 product.
Products include Libvips Libvips.
How do I fix CVE-2026-2913?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-2913 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2913 exists.
Other vulnerabilities in libvips
- CVE-2019-17534 Use after free in n/a
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
Sources
Also known as DEBIAN-CVE-2026-2913, GHSA-qjwf-h778-47mm, UBUNTU-CVE-2026-2913.