PT-2026-21863 · Libvips · Libvips

Niebelungen · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-3147

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.0

Description A flaw exists in libvips, specifically within the vips foreign load csv build function located in the libvips/foreign/csvload.c file. This issue can lead to a heap-based buffer overflow. Local access is required for exploitation. The vulnerability has been publicly disclosed.

Recommendations Apply the patch identified as b3ab458a25e0e261cbd1788474bbc763f7435780.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

CVE-2026-3147

Affected Products

Libvips

References · 19

• 🔥 https://github.com/libvips/libvips/issues/4874#issue-3943617697 · Exploit
• https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435780 · Patch
• https://github.com/libvips/libvips/pull/4894 · Patch
• https://github.com/libvips/libvips/issues/4874 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3147 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-3147 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3147 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3147 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3147 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3147 · Vendor Advisory
• https://vuldb.com/?id.347653 · Note
• https://twitter.com/CVEnew/status/2026641355619934323 · Twitter Post
• https://vuldb.com/?ctiid.347653 · Note
• https://t.me/cveNotify/153247 · Telegram Post