Is CVE-2026-6491 actively exploited?

No active exploitation of CVE-2026-6491 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-6491 be exploited remotely?

No. CVE-2026-6491 requires local access to exploit.

What is the CVSS score of CVE-2026-6491?

CVE-2026-6491 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-6491

MEDIUM

CVE-2026-6491

CWE-119Published: April 17, 2026· Updated: Apr 22, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.2th

Official Description

A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".

NVD Source

Technical Analysis

CVE-2026-6491 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.