CVE-2026-3284

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3284
A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_area results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. It is advisable to implement a patch to correct this issue.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

1.7 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/libvips/libvips/ Product
https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 Patch
https://github.com/libvips/libvips/issues/4879 Exploit Issue Tracking Vendor Advisory
https://github.com/libvips/libvips/issues/4879#issue-3944211794 Exploit Issue Tracking Vendor Advisory
https://github.com/libvips/libvips/pull/4887 Issue Tracking Patch
https://vuldb.com/?ctiid.348013 Permissions Required VDB Entry
https://vuldb.com/?id.348013 Third Party Advisory VDB Entry
https://vuldb.com/?submit.758864 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:libvips:libvips:8.19.0:*:*:*:*:*:*:*
History

02 Mar 2026, 16:30

Type Values Removed Values Added
References () https://github.com/libvips/libvips/ - () https://github.com/libvips/libvips/ - Product
References () https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 - () https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 - Patch
References () https://github.com/libvips/libvips/issues/4879 - () https://github.com/libvips/libvips/issues/4879 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/libvips/libvips/issues/4879#issue-3944211794 - () https://github.com/libvips/libvips/issues/4879#issue-3944211794 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/libvips/libvips/pull/4887 - () https://github.com/libvips/libvips/pull/4887 - Issue Tracking, Patch
References () https://vuldb.com/?ctiid.348013 - () https://vuldb.com/?ctiid.348013 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.348013 - () https://vuldb.com/?id.348013 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.758864 - () https://vuldb.com/?submit.758864 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:libvips:libvips:8.19.0:*:*:*:*:*:*:*
First Time Libvips libvips
Libvips

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en libvips 8.19.0. La función afectada es vips_extract_area_build del archivo libvips/conversion/extract.c. La manipulación del argumento extract_area resulta en desbordamiento de entero. El ataque requiere un enfoque local. El exploit se ha hecho público y podría ser utilizado. El parche se identifica como 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. Es aconsejable implementar un parche para corregir este problema.

27 Feb 2026, 03:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 03:16

Updated : 2026-03-02 16:30

NVD link : CVE-2026-3284

Mitre link : CVE-2026-3284

CVE.ORG link : CVE-2026-3284

JSON object : View

Products Affected

libvips

  • libvips
CWE
CWE-189

Numeric Errors

CWE-190

Integer Overflow or Wraparound