CVE-2026-88360: n/a
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service.
AI Analysis
Technical Summary
libvips version 8.19.0 contains a vulnerability triggered by malformed little-endian PFM image files whose text header length is not a multiple of four bytes. The mmap-based loader exposes pixel data at an address misaligned for float access. The vips_avg_scan() function then dereferences this buffer through a float pointer, causing undefined behavior and process termination on systems enforcing strict memory alignment or with UBSan instrumentation. This leads to a denial of service condition.
Potential Impact
The vulnerability causes denial of service by crashing the process when processing specially crafted PFM images with misaligned headers. There is no indication of code execution or data corruption beyond process termination.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed little-endian PFM images with libvips 8.19.0 on strict-alignment architectures or UBSan-instrumented builds.
CVE-2026-88360: n/a
Description
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libvips version 8.19.0 contains a vulnerability triggered by malformed little-endian PFM image files whose text header length is not a multiple of four bytes. The mmap-based loader exposes pixel data at an address misaligned for float access. The vips_avg_scan() function then dereferences this buffer through a float pointer, causing undefined behavior and process termination on systems enforcing strict memory alignment or with UBSan instrumentation. This leads to a denial of service condition.
Potential Impact
The vulnerability causes denial of service by crashing the process when processing specially crafted PFM images with misaligned headers. There is no indication of code execution or data corruption beyond process termination.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed little-endian PFM images with libvips 8.19.0 on strict-alignment architectures or UBSan-instrumented builds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-09-10T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6ab53135f7a7c541066a0303
Added to database: 09/24/2026, 14:18:29 UTC
Last enriched: 09/24/2026, 14:32:40 UTC
Last updated: 09/25/2026, 01:56:00 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.