CVE-2026-3146 - Vulnerability Analysis

Overview

libvips <= 8.18.0 contains a null pointer dereference caused by improper handling in vips_foreign_load_matrix_header function, letting local attackers cause denial of service, exploit requires local access.

Severity & Score

Impact

Local attackers can cause denial of service by crashing the application via null pointer dereference.

Mitigation

Apply the patch identified by d4ce337c76bff1b278d7085c3c4f4725e3aa6ece or update to a version later than 8.18.0.

References

• https://github.com/libvips/libvips/pull/4888
• https://vuldb.com/?ctiid.347652
• https://vuldb.com/?id.347652
• https://vuldb.com/?submit.758691
• https://github.com/libvips/libvips/
• https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
• https://github.com/libvips/libvips/issues/4875

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner