On this page (6 sections)

libvips is a widely used image processing library that many web applications call to resize, convert and thumbnail uploaded images. The upstream project has published fixes for three memory safety flaws in how it works out image dimensions: CVE-2025-59933, CVE-2026-33327 and CVE-2026-33328.

If your servers process images or PDFs that users or third parties can supply, such as avatars, product photos or imports, check which libvips version you run, directly or as a dependency, and apply the update. Your Linux distribution may ship its own patched packages, so check its security advisories for exact package versions.

What the three flaws are

All three are memory safety bugs in how libvips works out the size of an image before it allocates or reads memory. When a size is miscalculated, the library can read or write outside the buffer it intended to use.

CVE-2026-33327: vipsload integer overflow

According to the libvips advisory GHSA-2fcj-gj27-279x, the vipsload operation in versions up to and including 8.18.0 could incorrectly determine image dimensions. That leads to an integer overflow (CWE-190) and then a heap-based buffer overflow. It is the most serious of the three, rated High at 7.0. The advisory's CVSS v4 metrics list the attack vector as Local with low privileges required and high impact on integrity and availability. The upstream fix is commit 61e71c1, which adds a check that the combined image size cannot overflow.

CVE-2026-33328: gifload on 32-bit systems

The gifload advisory describes a similar integer overflow, limited to 32-bit systems, in versions up to 8.18.0. It is rated Medium at 6.8. The upstream change tightens the GIF dimension limits and rejects images whose pixel count is too large. Most modern servers are 64-bit, so exposure here is narrower.

CVE-2025-59933: PDF header over-read via poppler

The advisory GHSA-q8px-4w5q-c2r4 covers a buffer over-read when parsing a crafted PDF with a page that defines a width but not a height. It affects libvips 8.17.1 and below, and only when libvips was built with PDF input through poppler. Builds without PDF input, or using PDFium instead, are unaffected. The advisory says processing halts shortly after the over-read, no output is generated, and the consuming application cannot access the overflowed memory. It is rated Medium at 5.1 and was fixed in 8.17.2.

The upstream CVSS v4 metrics describe a local attack vector, but a web application that feeds uploaded files to libvips can still be an indirect path for untrusted input. Treat exposure as depending on how your application uses the library.

Who is realistically exposed

  • Web applications and APIs that resize or convert uploaded images using libvips, directly or through a language binding or wrapper library.
  • Image proxies, thumbnail services and origin workers that decode files from outside sources.
  • Content platforms and online stores that import product images or documents in bulk.
  • Servers where libvips is installed only as a dependency of another package. These are easy to forget during patching.
  • For the PDF issue specifically, systems where libvips was built with poppler support.

A server that has libvips installed but never opens untrusted files has a much lower practical risk. Still, patching is cheap compared with auditing every code path.

How to check your exposure

Start by finding out whether libvips is installed and which version it is. This command lists installed packages whose names contain vips on Debian and Ubuntu; look at the package names and versions in the output.

List installed libvips packages (Debian/Ubuntu)Shell
dpkg -l | grep -i vips

If the vips command-line tool is installed, this prints the libvips version. Compare it with the fixed upstream versions (8.18.1 and 8.17.2), keeping in mind that distributions may backport fixes without changing the upstream version number, so your distribution's advisory is the authority for its package versions.

Print the libvips version (any Linux host with the vips tool)Shell
vips --version

On RPM-based systems, this query prints matching package names and versions if libvips is present.

List installed libvips packages (RHEL and compatible)Shell
rpm -qa | grep -i vips

Also check whether your applications bundle their own copy of libvips. A system update will not change a bundled library, so look at the dependency documentation of any image-processing package your application uses.

What to do now

On Debian and Ubuntu, this refreshes package lists and installs available updates, including a libvips fix once your distribution publishes it for your release.

Caution. Upgrading packages and restarting services can briefly interrupt image processing and web requests. Schedule it in a maintenance window and test on a staging host first.
Install pending updates (Debian/Ubuntu)Shell
sudo apt update && sudo apt upgrade

Workaround if you cannot update immediately

The libvips advisories for CVE-2026-33327 and CVE-2025-59933 describe two mitigations. The first is to block the affected loader in code with vips_operation_block_set, available in most language bindings: block VipsForeignLoadVips for CVE-2026-33327, or VipsForeignLoadPdf for CVE-2025-59933. The second is to set the VIPS_BLOCK_UNTRUSTED environment variable at runtime, which blocks all untrusted loaders, including PDF input via poppler. The material we reviewed does not include a loader-specific workaround for the gifload issue (CVE-2026-33328), so upgrading to 8.18.1 is the confirmed fix there.

Tip. Blocking untrusted loaders can break features that rely on them. Test your upload and thumbnail flows after setting VIPS_BLOCK_UNTRUSTED, and treat it as a stopgap until the update is installed.

Monitoring afterwards

Memory corruption in an image library most often shows up as crashes rather than clear alerts. After patching, watch for repeated worker or process crashes, segmentation faults in system logs and unusual spikes in failed image conversions, especially after uploads of odd-looking files. Keep a record of which hosts and images carry libvips so the next advisory takes minutes to assess, not days.

To keep an eye on the public side of your sites, you can run a read-only check with Webforta Scan and review header and certificate changes with Webforta Monitor. These do not tell you whether a library on your server is patched, so keep the package checks above as your main control. For broader hygiene, see our small business website security guide.

What we could not confirm

Coverage of these flaws comes from the upstream libvips project (advisories, commits and release notes); only one independent publisher covers the story so far. We found no reports of exploitation in the wild. We did not review any distribution advisory, so we cannot list which distribution releases are covered or their fixed package versions.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. validate poppler page size (#4620) · libvips/libvips@a58bfaegithub.com
  2. Release v8.17.2 · libvips/libvipsgithub.com
  3. Buffer over-read in poppler-based pdfloadgithub.com
  4. Guard against dimension overflow (#4934) · libvips/libvips@61e71c1github.com
  5. Guard against dimension overflow by kleisauke · Pull Request #4934 · libvips/libvipsgithub.com
  6. Possible integer overflow leading to potential heap-based buffer overflowgithub.com
  7. gifload: guard against int overflow on 32-bit platforms (#4935) · libvips/libvips@9b633e4github.com
  • libvips
  • image processing
  • buffer overflow
  • integer overflow
  • patching