CVE-2026-6491 libvips nip2 vips7compat.c im_minpos_vec heap-based overflow
A heap-based buffer overflow in libvips allows local attackers to execute arbitrary code or cause denial of service via the deprecated nip2 handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6491?
CVE-2026-6491 is a medium-severity memory corruption vulnerability in libvips, published on 17 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".
Which versions are affected by CVE-2026-6491?
How do I fix CVE-2026-6491?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-6491 being exploited?
There is no known exploitation of CVE-2026-6491 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-6491, GHSA-qv7w-j9w9-35p3, UBUNTU-CVE-2026-6491.