USN-8994-1: libvips vulnerabilities

It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.

(CVE-2025-59933) It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2026-33327) It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.

(CVE-2026-33328) It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service.…

Abbreviated excerpt as provided by the publisher; the full article is at the canonical source. Attributed to Ubuntu Security Notices · Limited verification; verify facts against the linked source. Read the full article on ubuntu.com.

Source published: 03 Nov 2026, 11:09 PM IST. Source facts take precedence over AI interpretation.