CVE-2026-88360

Name of the Vulnerable Software and Affected Versions libvips version 8.19.0

Description A memory access issue occurs when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader may expose pixel data at an address not properly aligned for float access. The function vips avg scan() then dereferences the buffer using a float pointer, causing undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, which results in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.