CVE-2026-6491

CYBERSECURITY BRIEFING NOTE - CVE-2026-6491 OVERVIEW A heap-based buffer overflow vulnerability exists in libvips versions up to 8.18.2, specifically within the im_minpos_vec function in the deprecated vips7compat.c file used by the nip2 handler. The vulnerability is triggered through manipulation of the argument n parameter and is limited to the deprecated component of the library. The vendor has confirmed plans to remove the affected deprecated code in version 8.19. SEVERITY This vulnerability carries a CVSS 3.1 score of 5.3 (Medium) with a local attack vector requiring low privileges and no user interaction. The impact assessment indicates potential for confidentiality, integrity, and availability compromise. The FAUCET Risk Score of 32.0 and EPSS percentile positioning indicate this threat ranks lower than the majority of known CVEs, though the active status on the Hot List warrants monitoring. EXPLOITATION STATUS Public exploit disclosure has occurred and exploit code is available. However, this vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no indicators of active exploitation in the wild. The local attack requirement and deprecated code location limit real-world exploitation potential despite public availability of proof-of-concept code.