CVE-2026-3147 libvips csvload.c vips_foreign_load_csv_build heap-based overflow
A heap-based buffer overflow in libvips allows local attackers to execute arbitrary code or cause denial of service via crafted CSV files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3147?
CVE-2026-3147 is a medium-severity memory corruption vulnerability in libvips, published on 25 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3ab458a25e0e261cbd1788474bbc763f7435780. It is advisable to implement a patch to correct this issue.
Which versions are affected by CVE-2026-3147?
It affects 1 product.
Products include Libvips Libvips.
How do I fix CVE-2026-3147?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3147 exists.
Other vulnerabilities in libvips
- CVE-2019-17534 Use after free in n/a
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
Sources
Also known as DEBIAN-CVE-2026-3147, GHSA-55xf-4pmg-v3xm, UBUNTU-CVE-2026-3147.