CVE-2026-88360
Description
A flaw was found in libvips, an image processing library. When handling specially crafted little-endian PFM (Portable Float Map) images, an attacker could trigger an unaligned memory access. This occurs if the image's text header length is not a multiple of four bytes, causing the loader to expose pixel data at an incorrect memory address. Such unaligned access can lead to undefined behavior and cause the application to terminate, resulting in a denial of service (DoS) for affected systems.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires user interaction to process an untrusted, malformed image file and is restricted to causing an application crash without compromising confidentiality or integrity. In typical Red Hat deployments, libvips is utilized as a shared library for image manipulation pipelines, meaning the failure is confined to the specific consuming process or task. Furthermore, abnormal termination from unaligned pointer dereferencing primarily manifests on architectures enforcing strict memory alignment or under specific build instrumentation.
Understanding the Weakness (CWE)
Other
Technical Impact: Reduce Maintainability
This issue makes it more difficult to maintain and/or port the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
