CVE-2026-33328: 
Wolfi vulnerability analysis and mitigation

CVE-2026-33328 is an integer overflow vulnerability in libvips, a fast image processing library, affecting the gifload operation on 32-bit systems. On affected platforms (versions ≤ 8.18.0), the GIF loader could incorrectly determine image dimensions, leading to an integer overflow condition. The vulnerability was responsibly disclosed by Elhanan Haenel and patched in version 8.18.1, with the fix merged on March 7, 2026, and the advisory published on July 17–20, 2026. It carries a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory).

The root cause is CWE-190 (Integer Overflow or Wraparound) in the vips_foreign_load_nsgif_bitmap_create function within libvips/foreign/nsgifload.c. On 32-bit systems, the product of width * height could exceed INT_MAX / 4 without being caught, because the original bounds check allowed dimensions up to 65536 (inclusive) — meaning a 65536×65536 image would produce a pixel count that overflows a 32-bit integer. The fix tightens the per-axis limit to 65535 and adds an explicit check: (guint64) width * height > INT_MAX / 4, preventing the overflow by casting to a 64-bit type before multiplication (GitHub Commit, GitHub PR). Exploitation requires local access with low privileges and is limited to 32-bit system deployments of libvips.

Successful exploitation results in a high availability impact to the vulnerable system — specifically, the integer overflow can cause incorrect memory allocation or processing behavior when loading a crafted GIF image, potentially leading to a crash or denial of service of the application using libvips. There is no impact to confidentiality or integrity, and no subsequent system impact is expected. The vulnerability is scoped to 32-bit platforms only; 64-bit deployments are not affected (GitHub Advisory).

Upgrade libvips to version 8.18.1 or later, which contains the fix introduced in commit 9b633e4 (GitHub Commit). For deployments that cannot immediately upgrade, a workaround is to block the VipsForeignLoadNsgif operation using the vips_operation_block_set API, available in most language bindings: vips_operation_block_set("VipsForeignLoadNsgif", TRUE);. This workaround prevents GIF loading entirely but eliminates the vulnerable code path (GitHub Advisory).

The vulnerability was responsibly disclosed by security researcher Elhanan Haenel, and the fix was developed by libvips maintainer kleisauke and reviewed by project lead jcupitt. No significant broader media coverage or notable community debate has been observed beyond the standard advisory and patch publication (GitHub Advisory, GitHub PR).