CVE-2026-3145

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3145
A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. This patch is called d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. A patch should be applied to remediate this issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/libvips/libvips/ Product
https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece Patch
https://github.com/libvips/libvips/issues/4876 Exploit Issue Tracking Vendor Advisory
https://github.com/libvips/libvips/pull/4888 Issue Tracking Patch
https://vuldb.com/?ctiid.347651 Permissions Required VDB Entry
https://vuldb.com/?id.347651 Third Party Advisory VDB Entry
https://vuldb.com/?submit.758690 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:43

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en libvips hasta la versión 8.18.0. El elemento afectado es la función vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header del archivo libvips/foreign/matrixload.c. Al manipularlo se puede provocar una corrupción de memoria. El ataque debe lanzarse localmente. Este parche se llama d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. Se debe aplicar un parche para remediar este problema.

25 Feb 2026, 20:56

Type Values Removed Values Added
References () https://github.com/libvips/libvips/ - () https://github.com/libvips/libvips/ - Product
References () https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece - () https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece - Patch
References () https://github.com/libvips/libvips/issues/4876 - () https://github.com/libvips/libvips/issues/4876 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/libvips/libvips/pull/4888 - () https://github.com/libvips/libvips/pull/4888 - Issue Tracking, Patch
References () https://vuldb.com/?ctiid.347651 - () https://vuldb.com/?ctiid.347651 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.347651 - () https://vuldb.com/?id.347651 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.758690 - () https://vuldb.com/?submit.758690 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*
First Time Libvips libvips
Libvips

25 Feb 2026, 03:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 03:16

Updated : 2026-06-17 10:43

NVD link : CVE-2026-3145

Mitre link : CVE-2026-3145

CVE.ORG link : CVE-2026-3145

JSON object : View

Products Affected

libvips

  • libvips
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer