PT-2026-22288 · Libvips · Libvips

Niebelungen · Published 2026-02-27 · Updated 2026-03-02 · CVE-2026-3284

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvips version 8.19.0

Description A flaw exists in libvips 8.19.0 within the vips extract area build function, located in the libvips/conversion/extract.c file. Manipulation of the extract area argument can lead to an integer overflow. Exploitation requires local access. An exploit for this issue has been publicly released.

Recommendations Implement the patch identified as 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 to resolve this issue.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

CWE-189

Related Identifiers

CVE-2026-3284

Affected Products

Libvips

References · 19

• 🔥 https://github.com/libvips/libvips/issues/4879#issue-3944211794 · Exploit
• https://github.com/libvips/libvips/pull/4887 · Patch
• https://github.com/libvips/libvips/issues/4879 · Vendor Advisory
• https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 · Patch
• https://osv.dev/vulnerability/CVE-2026-3284 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3284 · Security Note
• https://ubuntu.com/security/CVE-2026-3284 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3284 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3284 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3284 · Security Note
• https://vuldb.com/?id.348013 · Note
• https://t.me/CVEtracker/45927 · Telegram Post
• https://twitter.com/CVEnew/status/2027380207586296157 · Twitter Post
• https://t.me/cveNotify/153775 · Telegram Post