{"id":"CVE-2026-2913","summary":"libvips source.c vips_source_read_to_memory heap-based overflow","details":"A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: \"[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself).\"","modified":"2026-10-26T17:26:57.322585893Z","published":"2026-02-22T04:02:13.421Z","related":["openSUSE-SU-2026:12266-1"],"database_specific":{"cwe_ids":["CWE-119","CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2913.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"},{"introduced":"8.5"},{"last_affected":"8.5"},{"introduced":"8.19.0"},{"last_affected":"8.19.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}],"cna_assigner":"VulDB"},"references":[{"type":"WEB","url":"https://github.com/libvips/libvips/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2913.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2913"},{"type":"ADVISORY","url":"https://vuldb.com/?id.347222"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.755224"},{"type":"REPORT","url":"https://github.com/libvips/libvips/issues/4857"},{"type":"REPORT","url":"https://github.com/libvips/libvips/issues/4857#issue-3920154326"},{"type":"REPORT","url":"https://github.com/libvips/libvips/issues/4857#issuecomment-3878479322"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.347222"},{"type":"FIX","url":"https://github.com/libvips/libvips/commit/a56feecbe9ed66521d9647ec9fbcd2546eccd7ee"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libvips/libvips","events":[{"introduced":"db291daf8147e12ef9a7aa68071694c83be9cc2e"},{"fixed":"a56feecbe9ed66521d9647ec9fbcd2546eccd7ee"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"8.1"},{"last_affected":"8.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"8.3"},{"last_affected":"8.3"}]},{"range":[{"introduced":"8.6"},{"last_affected":"8.6"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"8.7"},{"last_affected":"8.7"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"8.8"},{"last_affected":"8.8"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"8.9"},{"last_affected":"8.9"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"8.10"},{"last_affected":"8.10"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"8.11"},{"last_affected":"8.11"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"8.12"},{"last_affected":"8.12"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"8.13"},{"last_affected":"8.13"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"8.14"},{"last_affected":"8.14"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"8.15"},{"last_affected":"8.15"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"8.16"},{"last_affected":"8.16"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"8.17"},{"last_affected":"8.17"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"8.18"},{"last_affected":"8.18"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a56feecbe9ed66521d9647ec9fbcd2546eccd7ee"}]}]}}],"versions":["8.1","8.10","8.11","8.12","8.13","8.14","8.15","8.16","8.17","8.18","8.3","8.6","8.7","8.8","8.9","v8.18.0","v8.18.0-rc3","v8.18.0-rc2","v8.18.0-rc1","v8.18.0-alpha2","v8.18.0-alpha1","v8.17.0-rc1","v8.17.0","v8.17.0-test4","v8.17.0-test3","v8.17.0-test2","v8.17.0-test1","v8.16.0","v8.16.0-rc2","v8.16.0-rc1","v8.15.0","v8.15.0-rc2","v8.14.0","v8.14.0-rc1","v8.13.0","v8.13.0-rc2","v8.13.0-rc1","v8.13.0-pre1","v8.12.0","v8.12.0-rc1","v8.11.0","v8.11","v8.11.0-rc1","v8.10.6-beta2","v8.10.0","v8.10.0-rc2","v8.10.0-rc1","v8.10.0-beta2","v8.10.0-beta1","v8.9.0","v8.9.0-rc4","v8.9.0-rc3","v8.9.0-rc2","v8.9.0-rc1","v8.9.0-beta2","v8.9.0-beta1","v8.9.0-alpha1","v8.8.0-rc3","v8.8.0","v8.8.0-rc2","v8.8.0-rc1","v8.7.0","v8.7.0-rc3","v8.7.0-rc2","v8.7.0-rc1","v8.7.0-alpha2","v8.6.0","v8.6.0-beta2","v8.6.0-beta1","v8.6.0-alpha2","v8.6.0-alpha1","v8.5.3","v8.5.2","v8.5.1","v8.3.0","v8.2.2","v8.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-2913.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a56feecbe9ed66521d9647ec9fbcd2546eccd7ee","target":{"function":"vips_source_read_to_memory","file":"libvips/iofuncs/source.c"},"deprecated":false,"digest":{"length":775,"function_hash":"81264585116533091837063788852293356148"},"id":"CVE-2026-2913-5a11eaa3"},{"id":"CVE-2026-2913-7ef49fc9","signature_type":"Function","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a56feecbe9ed66521d9647ec9fbcd2546eccd7ee","target":{"file":"libvips/iofuncs/source.c","function":"vips_source_sniff_at_most"},"deprecated":false,"digest":{"function_hash":"279356752735390688259417901222994911966","length":574}},{"digest":{"threshold":0.9,"line_hashes":["291448142552276877238239624487094499721","277299268939537619061950602027585820324","57889987333450730656555089459468282285","186642217395441230341228737770801529885","127923444120314266074828930554756515529","31840049729374283735286227556657049616","40021833950460327588074593176553216811","277477501770652099506644695600975927493","187344673546717005577755839519469378636","97492122235911535734619043184465836729","167413512332663410538673819788118789172","299456589952915040149822499343749301177","10724964163555143445057729214951748917","91032309382667330543825027952811401080","1409473997676061592705228740946968134"]},"id":"CVE-2026-2913-86b7a855","signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/a56feecbe9ed66521d9647ec9fbcd2546eccd7ee","target":{"file":"libvips/iofuncs/source.c"},"deprecated":false}],"vanir_signatures_modified":"2026-10-22T16:19:34Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}