CVE-2026-3281 - Vulnerability Analysis

Overview

libvips 8.19.0 contains a heap-based buffer overflow caused by manipulation of the "index" argument in vips_bandrank_build function, letting local attackers cause memory corruption, exploit requires local access.

Severity & Score

Impact

Local attackers can cause memory corruption leading to potential denial of service or code execution.

Mitigation

Apply the patch fd28c5463697712cb0ab116a2c55e4f4d92c4088 or update to a fixed version.

References

• https://vuldb.com/?submit.758861
• https://github.com/libvips/libvips/
• https://github.com/libvips/libvips/commit/fd28c5463697712cb0ab116a2c55e4f4d92c4088
• https://github.com/libvips/libvips/issues/4878
• https://github.com/libvips/libvips/issues/4878#issue-3944209102
• https://github.com/libvips/libvips/pull/4895
• https://vuldb.com/?ctiid.348010
• https://vuldb.com/?id.348010

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner