USN-8994-1: Nine vulnerabilities in libvips, from DoS to code execution

Ubuntu released security notice USN-8994-1 on 3 November 2026, addressing nine vulnerabilities in libvips, the image processing library powering many resize and image conversion services used by websites and content management systems. For anyone running an instance with image upload pipelines (galleries, e-commerce platforms, CMSs with automatic thumbnails), this is a patch that cannot wait, because several flaws directly impact the parsing of files uploaded by external users.

What this notice fixes

Among the most serious issues are four integer overflows that can lead to arbitrary code execution, alongside various crashes (denial of service) and two cases of potential sensitive information disclosure. The details:

CVE	Problem	Impact	Affected releases
CVE-2025-59933	PDF with width but no height	crash or information leak	16.04–24.04
CVE-2026-33327	overflow in vipsload	crash or code execution	all
CVE-2026-33328	overflow in gifload on 32-bit	crash	24.04, 26.04
CVE-2026-35590	EXIF group validation	crash	all
CVE-2026-35591	incorrect channels in TIFF tile	crash or code execution	22.04, 24.04, 26.04
CVE-2026-69242	multiband TIFF scanline overflow	crash, information leak or code execution	all
CVE-2026-70651	TIFF frame height via ImageMagick	crash	all
CVE-2026-70653	Radiance image handling	information leak	all
CVE-2026-70654	read size on uncompressed PPM	crash or code execution	20.04–26.04

It was discovered that libvips did not correctly handle certain PDF files where a page defines a width but no height. An attacker could exploit this flaw to crash libvips, resulting in denial of service, or to obtain sensitive information.

The affected package is vips – image processing system good for very large ones, a component present by default on many server distributions.

Who should be concerned

libvips is not merely an isolated system library: it powers image processing in Mastodon, sharp (on Node.js), imgproxy, wsrv.nl, bimg, Ruby on Rails, CarrierWave, and MediaWiki. Anyone hosting Node.js applications that process image uploads via Sharp, or WordPress/MediaWiki installations with server-side image processing, inherits the same attack surface.

How to apply the patch

On all affected releases – from Ubuntu 16.04 LTS through 26.04 LTS – the fix is distributed through Ubuntu Pro via ESM Apps: patched versions range from libvips42-8.2.2-1ubuntu0.1esm1 (16.04) to libvips42t64-8.18.0-1ubuntu0.1esm2 (26.04). Without an active Ubuntu Pro subscription, the only option is to wait for a potential community fix, which is not yet available. The standard command sudo apt update && sudo apt upgrade applies the fix on systems already covered by Ubuntu Pro.