CVE-2026-3281 Details
Description
A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.
A heap-based buffer overflow vulnerability has been identified in libvips version 8.19.0. The issue arises in the bandrank functionality, specifically within the vips_bandrank_build function in bandrank.c. The vulnerability is triggered by user-controlled manipulation of the 'index' argument, which is not properly validated against the number of input images. This oversight allows for out-of-bounds memory access, leading to a heap overflow. The vulnerability requires local exploitation and has a public exploit available.
Users are advised to update to libvips version 8.19.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libvips/libvips/ | [email protected] | Product |
| https://github.com/libvips/libvips/commit/fd28c5463697712cb0ab116a2c55e4f4d92c4088 | [email protected] | Patch |
| https://github.com/libvips/libvips/issues/4878 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/libvips/libvips/issues/4878#issue-3944209102 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/libvips/libvips/pull/4895 | [email protected] | Issue TrackingPatch |
| https://vuldb.com/?ctiid.348010 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.348010 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.758861 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libvips libvips | 8.19.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 2, 2026 | Initial Analysis | [email protected] |
| Feb 27, 2026 | New CVE Received | [email protected] |