openSUSE Tumbleweed Ships Fixes for Nine libvips Image Library Flaws
openSUSE has issued advisory openSUSE-SU-2026:12266-1, rated moderate, resolving nine vulnerabilities in the libvips image processing library shipped on openSUSE Tumbleweed GA media. The update delivers libvips-devel 8.18.7-1.1 together with libvips42, typelib-1_0-Vips-8.0, vips-bash-completion, vips-doc, vips-modules-8.0 and vips-tools at the same version. The flaws span seven years and include CVE-2019-17534, CVE-2019-6976, CVE-2023-40032, CVE-2025-59933, CVE-2026-2913, CVE-2026-69242, CVE-2026-70651, CVE-2026-70652 and CVE-2026-70654. libvips is widely embedded in web applications and media pipelines that resize or convert user-supplied images, so any Tumbleweed host carrying these packages falls within scope.
The announcement does not publish exploitation details for the individual flaws, and no proof-of-concept code is referenced. The only issue scored in the advisory is CVE-2026-2913, which SUSE rates 2.5 using the CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. That vector describes a local, high-complexity weakness requiring low privileges, with impact limited to availability and none to confidentiality or integrity. The remaining eight CVEs carry no SUSE score here, and the fixes reach users as a consolidated GA media refresh rather than as separately documented patches.
Image parsing libraries are a recurring target because they process untrusted input by design, and libvips commonly sits directly behind upload handlers, thumbnailing services and document conversion workflows. Current exploitation likelihood is low across the set: FIRST EPSS gives CVE-2019-6976 a 2.2 percent and CVE-2019-17534 a 2.1 percent probability in the next 30 days, while the other seven sit at 0.3 percent or below. No confirmed in-the-wild exploitation is reported for any of the nine, leaving unpatched hosts a latent rather than active risk.
Attack Surface
Endpoint OS, Server OS, Web Application
Tactics
Initial Access, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- Install the openSUSE-SU-2026:12266-1 update on openSUSE Tumbleweed so that libvips-devel, libvips42, typelib-1_0-Vips-8.0, vips-bash-completion, vips-doc, vips-modules-8.0 and vips-tools all report version 8.18.7-1.1.
- Inventory affected hosts with 'rpm -q libvips42 libvips-devel vips-tools' or 'zypper se -si vips' and flag any system still reporting a version below 8.18.7-1.1.
- Refresh GA media and repository metadata before patching with 'zypper refresh' followed by 'zypper up libvips42 libvips-devel vips-tools vips-modules-8.0', since this advisory is delivered as a consolidated Tumbleweed GA media update rather than individual CVE patches.
- Identify applications that link against libvips (for example sharp-based Node.js services, Ruby image_processing pipelines and PHP thumbnailers) and restart those services after the package upgrade so long-running processes drop the old shared library.
- Restrict the image formats accepted by upload handlers that call vips or vipsthumbnail, rejecting formats your application does not need such as SVG, PDF and TIFF, to reduce the number of libvips loaders reachable from untrusted input.
- Run image conversion with vipsthumbnail or vips under a dedicated low-privilege account inside a systemd unit using MemoryMax and TimeoutStartSec limits, so the availability impact described in CVE-2026-2913 cannot exhaust the wider host.
- Alert on repeated crashes or abnormal termination of processes named vips, vipsthumbnail or any service loading libvips42, and correlate those events with recent image upload activity in web server logs.
