CVE-2026-3284

Feb. 27, 2026, 2:06 p.m.

4.8
Medium

Description

A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_area results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. It is advisable to implement a patch to correct this issue.

Product(s) Impacted

Vendor Product Versions
Libvips
  • Libvips
  • 8.19.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-189
None
None

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a libvips libvips 8.19.0 / / / / / / /

References

https://github.com/libvips/libvips/
https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70
https://github.com/libvips/libvips/issues/4879
https://github.com/libvips/libvips/issues/4879#issue-3944211794
https://github.com/libvips/libvips/pull/4887
https://vuldb.com/?ctiid.348013
https://vuldb.com/?id.348013
https://vuldb.com/?submit.758864

Tags

[email protected]
CWE-189
2026-02-27
CVE-2026-3284

CVSS Score

4.8 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Feb. 27, 2026, 3:16 a.m.
Last Modified: Feb. 27, 2026, 2:06 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.