CVE-2026-70651

Check whether your libvips deployment includes libtiff support. If it does not, you are running the vulnerable code path—and the 'most builds are unaffected' qualifier in the advisory does not apply to you. The vulnerability (CVE-2026-70651) is a bounds-checking omission in the ImageMagick fallback loader: when libvips is built with ImageMagick support but without libtiff, the code multiplies per-frame dimensions by frame count without validating the result. This is the same class of flaw that appears repeatedly in multi-frame image processing across this ecosystem. The fix in version 8.18.3 adds the missing check. Here's what matters for defenders: the vulnerable population is not random. It concentrates in precisely the environments where security-conscious decisions create the trigger condition—minimal container images, embedded systems, and hardened builds where maintainers stripped libtiff to reduce attack surface. Paradoxically, that hardening step activates the unchecked fallback path. The EPSS score of 0.00121 reflects general exploit probability across all libvips installs, not the elevated consequence when this code path runs in an isolated container often executing as root. More importantly, understand the remediation timeline. This is not a drop-in patch. The vulnerable path is activated by build configuration, not runtime state. Remediation requires rebuilding your image with libtiff included or upgrading to 8.18.3 and retesting. For minimal images designed for stability, this rebuild cycle can take weeks—longer than typical CVE patching timelines. The population most affected by this vulnerability is also the slowest to remediate. Audit your build pipelines: confirm whether libvips was compiled without libtiff, and if so, treat this as a build-system reconfiguration task rather than a simple package update. Also check whether similar unbounded dimension calculations exist in other image loaders in your stack—this vulnerability class has a documented history in fallback code paths across image processing libraries.

Reviewed through automated stages and approved by a human before publication.