CVE-2026-70651
Description
A flaw was found in libvips, an image processing library. When libvips is built without libtiff support but with ImageMagick support, an integer overflow can occur while loading a crafted multi-page Tagged Image File Format (TIFF) image. This overflow, caused by unchecked calculations of image frame height, can lead to a heap buffer over-read and result in a process crash, causing a Denial of Service (DoS).
Statement
This Moderate impact flaw in libvips occurs when the library is built without libtiff support but with ImageMagick, allowing a local attacker to trigger a denial of service by providing a crafted multi-page TIFF image. Most Red Hat package builds include libtiff, which prevents the vulnerable fallback path, thereby limiting exposure in typical installations.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
