Skip to main content

Libvips CVE-2026-3283

LOW
Buffer Overflow (CWE-119)
2026-02-27 cna@vuldb.com
3.3
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Mar 02, 2026 - 17:56 vuln.today
Public exploit code
Patch released
Mar 02, 2026 - 17:56 nvd
Patch available
CVE Published
Feb 27, 2026 - 03:16 nvd
LOW 3.3

DescriptionCVE.org

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. [CVSS 3.3 LOW]

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Libvips. A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible.

CVE-2019-17534 HIGH POC
8.8 Oct 13

vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG

CVE-2018-7998 HIGH POC
7.5 Mar 09

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio

CVE-2026-33327 HIGH POC
7.0 Jul 20

Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipslo

CVE-2021-27847 MEDIUM POC
6.5 Jul 15

Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point

CVE-2026-3145 MEDIUM POC
5.3 Feb 25

Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker

CVE-2020-20739 MEDIUM POC
5.3 Nov 20

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c

CVE-2026-3282 LOW POC
3.3 Feb 27

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li

CVE-2026-3146 LOW POC
3.3 Feb 25

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he

CVE-2026-35591 HIGH
7.0 Jul 20

Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF ima

CVE-2026-35590 MEDIUM
6.8 Jul 20

Denial of service in libvips 8.18.1 and earlier arises from the EXIF decoder's failure to validate Image File Directory

CVE-2026-33328 MEDIUM
6.8 Jul 20

Integer overflow in libvips gifload on 32-bit platforms allows an attacker who can supply crafted GIF images to cause in

CVE-2026-3281 LOW POC
1.9 Feb 27

Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a

Share

CVE-2026-3283 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy