{"action":"Upgrade vips to 8.18.0-2 or later.","affected":[{"fixed":"8.18.0-2","introduced":"0"}],"component":"vips","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["8.18.0-2"],"id":"tcs_01M5NRHMS91RVCMHV30HN9847A","modified_at":"2026-10-01T03:03:09.271385724Z","published_at":"2026-02-22T04:15:59.790Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-2913","https://security-tracker.debian.org/tracker/CVE-2026-2913"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-2913#Debian:14/vips","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-2913"}],"summary":"A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer"}