CVE-2026-69242

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69242
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69242.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69242
Aliases
  • GHSA-9rwc-f68v-4482
Downstream
Published
2026-08-20T21:02:58.466Z
Modified
2026-08-24T03:59:14.253117Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H CVSS Calculator
Summary
libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write
Details

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vipsimagesanity. The resulting buffer-region calculation can access attacker-controlled negative offsets in mmap-resident allocations, allowing reads or writes of other image data, possible data disclosure through uncompressed .v output, and likely process crashes. Remote code execution has not been demonstrated but cannot be ruled out. This issue is fixed in version 8.18.3.

Database specific 
{
    "cwe_ids": [
        "CWE-122",
        "CWE-190"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69242.json"
}
References

Affected packages

Git / github.com/libvips/libvips

Affected ranges

Type
GIT
Repo
https://github.com/libvips/libvips
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c72f50927413cd2451837d9813f954bc5d88f548
Fixed
3664cfc5dc2c5661288f5bf5a85ccc51c64c1626
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.18.3"
        }
    ]
}

Affected versions

v7.*
v7.28.0
v8.*
v8.0-beta
v8.1
v8.10.0
v8.10.0-beta1
v8.10.0-beta2
v8.10.0-rc1
v8.10.0-rc2
v8.10.6-beta2
v8.11
v8.11.0
v8.11.0-rc1
v8.12.0
v8.12.0-rc1
v8.13.0
v8.13.0-pre1
v8.13.0-rc1
v8.13.0-rc2
v8.14.0
v8.14.0-rc1
v8.15.0
v8.15.0-rc2
v8.16.0
v8.16.0-rc1
v8.16.0-rc2
v8.17.0
v8.17.0-rc1
v8.17.0-test1
v8.17.0-test2
v8.17.0-test3
v8.17.0-test4
v8.18.0
v8.18.0-alpha1
v8.18.0-alpha2
v8.18.0-rc1
v8.18.0-rc2
v8.18.0-rc3
v8.18.1
v8.18.2
v8.18.3-rc1
v8.2.2
v8.3.0
v8.5.1
v8.5.2
v8.5.3
v8.6.0
v8.6.0-alpha1
v8.6.0-alpha2
v8.6.0-beta1
v8.6.0-beta2
v8.7.0
v8.7.0-alpha2
v8.7.0-rc1
v8.7.0-rc2
v8.7.0-rc3
v8.8.0
v8.8.0-rc1
v8.8.0-rc2
v8.8.0-rc3
v8.9.0
v8.9.0-alpha1
v8.9.0-beta1
v8.9.0-beta2
v8.9.0-rc1
v8.9.0-rc2
v8.9.0-rc3
v8.9.0-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69242.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "40871188566960555797534865343993917120",
                "280583468346626059971461642282471659907",
                "124457516850962973310175479744249140645",
                "328053393552607056949457160698094811715",
                "215634287215946805611721991023061710430",
                "156768635521381228100771632092021262850",
                "277582039530558050549102845751760158295",
                "293496822736095924310907936123479200764",
                "247399218563492718961184865847735965900",
                "335249549507646226668533406698177255556",
                "39003126028108026901725344741125630115",
                "319954858964960260251026803592065571652",
                "287170327211599960049231835358937974244",
                "93930203671943223743569148747746365986"
            ]
        },
        "target": {
            "file": "libvips/foreign/radiance.c"
        },
        "source": "https://github.com/libvips/libvips/commit/3664cfc5dc2c5661288f5bf5a85ccc51c64c1626",
        "signature_version": "v1",
        "id": "CVE-2026-69242-4e5493d3",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "122366807374634489979775388286057279246",
            "length": 1383.0
        },
        "target": {
            "function": "vips_image_sanity",
            "file": "libvips/iofuncs/image.c"
        },
        "source": "https://github.com/libvips/libvips/commit/c72f50927413cd2451837d9813f954bc5d88f548",
        "signature_version": "v1",
        "id": "CVE-2026-69242-59059de0",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "72490777654407013462939268128658569853",
            "length": 994.0
        },
        "target": {
            "function": "scanline_read_old",
            "file": "libvips/foreign/radiance.c"
        },
        "source": "https://github.com/libvips/libvips/commit/3664cfc5dc2c5661288f5bf5a85ccc51c64c1626",
        "signature_version": "v1",
        "id": "CVE-2026-69242-aed2a489",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "253890947608346929490366203803839091008",
                "131986125286913172327593862829438650662",
                "121565464538090470990721528878402689962"
            ]
        },
        "target": {
            "file": "libvips/iofuncs/image.c"
        },
        "source": "https://github.com/libvips/libvips/commit/c72f50927413cd2451837d9813f954bc5d88f548",
        "signature_version": "v1",
        "id": "CVE-2026-69242-b6bc89e0",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-24T03:59:14Z"