CVE-2026-3282 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds
A local attacker can trigger an out-of-bounds read in libvips via the alpha_band argument, potentially causing information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3282?
CVE-2026-3282 is a medium-severity memory corruption vulnerability in libvips, published on 27 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.
Which versions are affected by CVE-2026-3282?
It affects 1 product.
Products include Libvips Libvips.
How do I fix CVE-2026-3282?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3282 exists.
Other vulnerabilities in libvips
- CVE-2019-17534 Use after free in n/a
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
Sources
Also known as DEBIAN-CVE-2026-3282, GHSA-pg5c-mhhq-cqhh, UBUNTU-CVE-2026-3282.