PT-2026-22287 · Libvips · Libvips

Niebelungen · Published 2026-02-27 · Updated 2026-03-02 · CVE-2026-3283

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvips version 8.19.0

Description A flaw exists in libvips 8.19.0 within the vips extract band build function, located in the libvips/conversion/extract.c file. Manipulation of the extract band argument can lead to an out-of-bounds read. Local execution is required for exploitation. The patch identifier is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. The exploit has been publicly disclosed.

Recommendations Deploy the patch with identifier 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2026-3283

Affected Products

Libvips

References · 19

• 🔥 https://github.com/libvips/libvips/issues/4880#issue-3944214985 · Exploit
• https://github.com/libvips/libvips/pull/4887 · Patch
• https://github.com/libvips/libvips/issues/4880 · Vendor Advisory
• https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 · Patch
• https://osv.dev/vulnerability/CVE-2026-3283 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3283 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3283 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-3283 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3283 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3283 · Vendor Advisory
• https://twitter.com/CVEnew/status/2027380208555204734 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027303208419291607 · Twitter Post
• https://t.me/CVEtracker/45926 · Telegram Post
• https://vuldb.com/?submit.758863 · Note