Libvips Vulnerabilities — Ubuntu Security Update (USN-8994-1)

It was discovered that libvips incorrectly handled certain PDF files with a
page that defines a width but not a height. An attacker could possibly use
this issue to cause libvips to crash, resulting in a denial of service, or
obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2025-59933)

It was discovered that libvips incorrectly determined image dimensions in
the vipsload operation, leading to an integer overflow. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33327)

It was discovered that libvips incorrectly determined image dimensions in
the gifload operation on 32-bit systems, leading to an integer overflow. An
attacker could possibly use this issue to cause libvips to crash, resulting
in a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-33328)

It was discovered that libvips did not properly validate EXIF tag groups.
An attacker could possibly use this issue to cause libvips to crash,
resulting in a denial of service. (CVE-2026-35590)

It was discovered that libvips incorrectly determined the number of
channels in certain encoded tiles within TIFF images. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591)

It was discovered that libvips incorrectly validated scanlines in certain
TIFF images with many bands, leading to an integer overflow. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service, obtain sensitive information, or possibly execute
arbitrary code. (CVE-2026-69242)

It was discovered that libvips incorrectly calculated frame heights when
loading certain multi-page TIFF images through ImageMagick. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service. (CVE-2026-70651)

It was discovered that libvips incorrectly handled certain Radiance images.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-70653)

It was discovered that libvips incorrectly calculated read sizes when
processing certain uncompressed PPM images from custom sources. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu
26.04 LTS. (CVE-2026-70654)