Ubuntu patches nine libvips vulnerabilities across all LTS releases, some allowing code execution

Canonical has released USN-8994-1, a security update for libvips that addresses nine CVEs spanning every supported Ubuntu LTS release from 16.04 through 26.04. The vulnerabilities involve incorrect handling of malformed image files across multiple formats, with severity ranging from denial of service to potential arbitrary code execution. Several flaws are specific to particular Ubuntu versions: the PDF width-without-height bug (CVE-2025-59933) affects 16.04 through 24.04 but not 26.04, while the GIF dimension overflow on 32-bit systems (CVE-2026-33328) only affects 24.04 and 26.04. The TIFF channel miscount (CVE-2026-35591) and PPM read size miscalculation (CVE-2026-70654) are similarly version-restricted. Fixes are available through Ubuntu Pro's ESM Apps subscription, with community fixes potentially becoming public later.

The most severe issues involve integer overflows in vipsload (CVE-2026-33327), TIFF scanline validation with many bands (CVE-2026-69242), and uncompressed PPM processing (CVE-2026-70654), all of which open paths to arbitrary code execution. Two additional flaws permit information disclosure: the PDF handling bug and a Radiance image parsing issue (CVE-2026-70653). The remaining vulnerabilities are denial-of-service conditions through crashes in EXIF tag validation, TIFF frame height calculation via ImageMagick, and the aforementioned GIF and PDF handlers.

Vulnerability breakdown by image format and attack vector

• PDF parser (CVE-2025-59933): libvips fails to handle PDF pages that define width without height, causing crashes or information disclosure; affects Ubuntu 16.04 LTS through 24.04 LTS but not 26.04 LTS.
• Native format loader (CVE-2026-33327): The vipsload operation miscalculates image dimensions, leading to integer overflow with potential for arbitrary code execution; affects all listed LTS releases.
• GIF loader on 32-bit (CVE-2026-33328): Dimension determination flaws in gifload cause integer overflow exclusively on 32-bit systems running Ubuntu 24.04 LTS or 26.04 LTS, resulting in denial of service.
• TIFF multi-channel handling (CVE-2026-35591, CVE-2026-69242): Two distinct flaws affect TIFF parsing—incorrect channel counts in encoded tiles (CVE-2026-35591, 22.04-26.04) and scanline validation failures with many bands (CVE-2026-69242, all releases); both permit crashes, with the latter also enabling information leak or code execution.
• PPM, Radiance, and EXIF auxiliary vectors (CVE-2026-70654, CVE-2026-70653, CVE-2026-35590, CVE-2026-70651): Uncompressed PPM read size miscalculations from custom sources allow code execution (20.04-26.04); Radiance images leak sensitive information; EXIF tag group validation failures and ImageMagick-mediated multi-page TIFF frame height errors cause denial of service.

Why it matters

libvips is a foundational image processing library deployed in web services, content management systems, and scientific computing pipelines where memory-efficient handling of large images is critical. These vulnerabilities expose server-side applications that accept user-uploaded images to remote exploitation, particularly concerning for platforms running on 32-bit ARM or x86 hardware still supported in cloud and edge deployments. The ESM Apps distribution model means organizations without Ubuntu Pro subscriptions may face delayed access to patches, creating a security gap for community and small-business users dependent on libvips in production environments.