CVE-2026-35591: 
Wolfi vulnerability analysis and mitigation

CVE-2026-35591 is a heap-based buffer overflow vulnerability in libvips, a fast image processing library, affecting the tiffload operation. The flaw exists in all versions up to and including 8.18.1, where the library could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. The vulnerability was discovered and responsibly disclosed by researcher wooseokdotkim, with the fix merged on March 26, 2026, and the advisory published on July 17–20, 2026. It carries a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory).

The root cause is a missing validation check (CWE-122: Heap-based Buffer Overflow) in the TIFF image loading code path. When processing a TIFF file containing JPEG or JPEG2000-encoded tiles, libvips failed to verify that the number of image components (channels) reported by the compressed tile matched the number of channels expected from the TIFF photometric interpretation metadata. This mismatch could cause the library to write beyond the bounds of a heap-allocated buffer. The fix, implemented in commit df044e4, adds explicit component count validation in both tiff2vips.c (checking cinfo->output_components != bytes_per_pixel for JPEG tiles) and jp2kload.c (adding a bounds check decompress.image->numcomps > out->Bands for JPEG2000 tiles) (GitHub PR #4973, Patch Commit). Exploitation requires local access and low privileges, with no user interaction needed.

Successful exploitation of this vulnerability can result in high integrity and availability impact on the vulnerable system, with limited confidentiality exposure. An attacker who can supply a specially crafted TIFF file to an application using libvips could trigger a heap buffer overflow, potentially leading to application crashes (denial of service), memory corruption, or arbitrary code execution within the context of the process loading the image. Applications that process user-supplied TIFF images — such as image conversion services, web applications, or content management systems using libvips — are at risk (GitHub Advisory).

1. Craft a malicious TIFF file: Create a TIFF image that contains a JPEG or JPEG2000-encoded tile where the number of color components (channels) in the compressed tile data does not match the number of channels declared in the TIFF's photometric interpretation tag (e.g., declare 3 channels in the TIFF header but embed a single-channel JPEG tile).
2. Deliver the file to the target: As a low-privileged local user, supply the crafted TIFF file to an application or service that uses libvips ≤ 8.18.1 to process images (e.g., via a file upload interface, shared directory, or direct API call).
3. Trigger the tiffload operation: Cause the application to load the malicious TIFF using libvips's tiffload or equivalent operation, which will invoke the vulnerable JPEG/JP2K tile decompression path.
4. Trigger heap buffer overflow: The missing component count validation causes libvips to write image data beyond the bounds of the allocated heap buffer, resulting in memory corruption, a crash, or potentially controlled code execution depending on heap layout (GitHub Advisory, Patch Commit).

• Process: Unexpected crashes or segmentation faults in processes using libvips when processing TIFF files; core dumps from image processing services.
• Logs: Application error logs showing libvips errors related to TIFF loading (e.g., "bad dimensions", "too many image bands") or abrupt process termination during image processing.
• File System: Presence of unusual or externally supplied TIFF files with mismatched photometric interpretation and embedded JPEG/JPEG2000 tile channel counts in upload directories or processing queues.

Upgrade libvips to version 8.18.2 or later, which includes the fix in commit df044e4 that validates JPEG and JPEG2000 component counts against the expected channel count from the TIFF photometric interpretation (GitHub Advisory). For those unable to upgrade immediately, a workaround is to block the VipsForeignLoadTiff operation using the vips_operation_block_set API, which is available in most language bindings: vips_operation_block_set("VipsForeignLoadTiff", TRUE);. Additionally, restricting the processing of untrusted TIFF files at the application layer reduces exposure.

The vulnerability was responsibly disclosed by researcher wooseokdotkim, who also reviewed the patch and confirmed it was correct before requesting CVE assignment. The fix was reviewed and approved by libvips maintainer kleisauke and merged by project lead jcupitt (GitHub PR #4973). No broader media coverage or notable community discussion beyond the GitHub advisory and pull request has been identified at this time.