Skip to main content

Libvips CVE-2026-3282

LOW
Buffer Overflow (CWE-119)
2026-02-27 cna@vuldb.com
3.3
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Mar 02, 2026 - 17:58 vuln.today
Public exploit code
Patch released
Mar 02, 2026 - 17:58 nvd
Patch available
CVE Published
Feb 27, 2026 - 03:16 nvd
LOW 3.3

DescriptionCVE.org

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

AnalysisAI

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. [CVSS 3.3 LOW]

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Libvips. A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible.

CVE-2019-17534 HIGH POC
8.8 Oct 13

vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG

CVE-2018-7998 HIGH POC
7.5 Mar 09

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio

CVE-2026-33327 HIGH POC
7.0 Jul 20

Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo

CVE-2021-27847 MEDIUM POC
6.5 Jul 15

Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point

CVE-2026-3145 MEDIUM POC
5.3 Feb 25

Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker

CVE-2020-20739 MEDIUM POC
5.3 Nov 20

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c

CVE-2026-3283 LOW POC
3.3 Feb 27

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li

CVE-2026-3146 LOW POC
3.3 Feb 25

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he

CVE-2026-35591 HIGH
7.0 Jul 20

Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima

CVE-2026-35590 MEDIUM
6.8 Jul 20

Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory

CVE-2026-33328 MEDIUM
6.8 Jul 20

Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in

CVE-2026-3281 LOW POC
1.9 Feb 27

Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a

Share

CVE-2026-3282 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy