CVE-2026-2913

libvips source.c vips_source_read_to_memory heap-based overflow

2.0LowCVSS base score
0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

Show the exploits1

References tagged exploit1 reference

https://github.com/libvips/libvips/issues/4857#issue-3920154326 (opens in a new tab)exploitissue-tracking

Timeline

2026
20 Feb 2026
20 Feb 2026
ID reserved
By VulDB
22 Feb 20262 days later
22 Feb 2026· 2 days later
Published
23 Feb 20261 day later
23 Feb 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-2913, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Low2.0	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Low2.5	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)	3.0	Low2.5	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)	2.0	Low1.0	AV:L/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
NVDNVD · Analyzed	4.0	Low1.1	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.21% · top 88% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.0.

Affected products

libvips
- affected 8.0
- affected 8.1
- affected 8.2
- affected 8.3
- affected 8.4
- affected 8.5
- affected 8.6
- affected 8.7
- affected 8.8
- affected 8.9
- affected 8.10
- affected 8.11
- affected 8.12
- affected 8.13
- affected 8.14
- affected 8.15
- affected 8.16
- affected 8.17
- affected 8.18
- affected 8.19.0

References

VDB-347222 | libvips source.c vips_source_read_to_memory heap-based overflow (opens in a new tab)vdb-entrytechnical-description
VDB-347222 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
Submit #755224 | libvips (libvips project) libvips 8.19.0 Integer Overflow to Buffer Overflow (opens in a new tab)third-party-advisory
https://github.com/libvips/libvips/issues/4857 (opens in a new tab)issue-tracking
https://github.com/libvips/libvips/issues/4857#issuecomment-3878479322 (opens in a new tab)issue-tracking
https://github.com/libvips/libvips/issues/4857#issue-3920154326 (opens in a new tab)exploitissue-tracking
https://github.com/libvips/libvips/commit/a56feecbe9ed66521d9647ec9fbcd2546eccd7ee (opens in a new tab)patch
https://github.com/libvips/libvips/ (opens in a new tab)product

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-2913](https://cveledger.app/badge/CVE-2026-2913.svg)](https://cveledger.app/cve/CVE-2026-2913)

Record last updated 23 Feb 2026, 19:14 UTC.