CVE-2026-3283 libvips extract.c vips_extract_band_build out-of-bounds
A local attacker can trigger an out-of-bounds read in libvips, potentially causing a crash or leaking sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3283?
CVE-2026-3283 is a medium-severity memory corruption vulnerability in libvips, published on 27 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.
Which versions are affected by CVE-2026-3283?
It affects 1 product.
Products include Libvips Libvips.
How do I fix CVE-2026-3283?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3283 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3283 exists.
Other vulnerabilities in libvips
- CVE-2019-17534 Use after free in n/a
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
Sources
Also known as DEBIAN-CVE-2026-3283, GHSA-93j6-h3cr-cp28, UBUNTU-CVE-2026-3283.