ANT-2026-JBKARRJ7 · libvips/libvips

oob-write low

CVE-2026-35590 GHSA-jmwm-wc68-mhwm

Severity Claude low · Security research firm low · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-JBKARRJ7: Out-of-bounds IFD array access in EXIF metadata processing leading to write through corrupted pointer

An out-of-bounds index into the IFD array during EXIF parsing produces a corrupted pointer that is then used as a write target.

Target

Project: libvips
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-JBKARRJ7.

Reference: ANT-2026-JBKARRJ7
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict
true positive
Severity
low
UPSTREAM FIX

The change that resolved this finding.

diff --git a/ChangeLog b/ChangeLog
index bc3e3ace80..5ea68a830d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,7 @@
 date-tbd 8.18.2
 
 - convolution: avoid using unsigned accumulators [nakrovati]
+- exif: check ifdN range [trailofbits]
 - tiffload: check jpeg and jp2k components [wooseokdotkim]
 - uhdrsave: set Q for gainmap recompress, don't chroma subsample RGB gainmaps
 - uhdrsave: prevent early unref of image with alpha channel [lovell]
diff --git a/libvips/foreign/exif.c b/libvips/foreign/exif.c
index b98e8cfd06..db4395b5e0 100644
--- a/libvips/foreign/exif.c
+++ b/libvips/foreign/exif.c
@@ -1284,6 +1284,11 @@ vips_exif_image_field(VipsImage *image,
 
 	p = field + strlen("exif-ifd");
 	ifd = atoi(p);
+	if (ifd < 0 ||
+		ifd >= EXIF_IFD_COUNT) {
+		g_warning("bad exif ifd %d in \"%s\"", ifd, field);
+		return NULL;
+	}
 
 	for (; g_ascii_isdigit(*p); p++)
 		;

https://github.com/libvips/libvips/commit/91ebd4d35341a8353ea490392d556d582e4b846f

TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-26 Sent to maintainer
  2. 2026-03-29 Reported to tracker
  3. 2026-03-31 Patch released
  4. 2026-05-09 Maintainer acknowledged
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

3d086296fdc3ee597627329b2198c6f0a171f3bd2c5912fead06195a09493bc3afd1314179768a43ecdd28a66f5fc9a18544fc24276ed804afd3496622bb7325

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-JBKARRJ7",
  "bug_class": "Out-of-bounds Write",
  "claude_severity": "low",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:13+00:00",
  "description": "An out-of-bounds index into the IFD array during EXIF parsing produces a corrupted pointer that is then used as a write target.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "libvips",
  "reproduction": null,
  "technical_details": null,
  "title": "Out-of-bounds IFD array access in EXIF metadata processing leading to write through corrupted pointer",
  "vendor_severity": "low"
}