CVE-2026-31877 exposureCVE-2026-31877 exposure
You
Are we exposed to CVE-2026-31877 in libimg?
Assistant
The CVE-2026-31877 advisory affects libimg before 4.2.9.
- Severity: Critical (CVSS 9.1), remote code execution via crafted TIFF.
- Our exposure: the thumbnail worker uses 4.2.6 but only accepts PNG and JPEG, so the vulnerable path is not reachable.
- Recommendation: upgrade in the next routine release, no emergency patch needed.
You
How risky is the upgrade to 4.2.9?
Assistant
The upgrade is a patch bump with no API changes.
- 4.2.6 to 4.2.9 touches only the TIFF decoder and a memory-pool fix.
- Thumbnail tests should pass unchanged.
You
Can you confirm the worker really rejects TIFF before decoding?
Assistant
Yes, the thumbnail worker rejects anything that is not PNG or JPEG by magic bytes before decode runs, so a TIFF never reaches libimg.
You
File a ticket for the upgrade.
Assistant
Ticket SEC-96 opened: upgrade libimg to 4.2.9 in the next routine release, priority low.