Every CVE Search/ Get API key

CVE-2026-3282

libvips unpremultiply.c vips_unpremultiply_build out-of-bounds

4.8 MediumFix available

CVE-2026-3282 is a medium vulnerability (CVSS 4.8) in Libvips, published February 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in vips 8.14.1-3+deb12u3.

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.24%Up 0.2 points since Feb 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

libvips unpremultiply.c vips_unpremultiply_build out-of-bounds

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
CVE-2026-3282
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C
Weakness
CWE-125, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-8989 4.8

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
EUVD-2026-8989
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-pg5c-mhhq-cqhh 1.9

A flaw has been found in libvips 8.19.0. This vulnerability affects the function...

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
GHSA-pg5c-mhhq-cqhh
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119
Updated
2026-11-02
NVD 1.9

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
CVE-2026-3282
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSV 1.9

libvips unpremultiply.c vips_unpremultiply_build out-of-bounds

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
CVE-2026-3282
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-3282 7.1

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
DEBIAN-CVE-2026-3282
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-3282 1.9

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Record
UBUNTU-CVE-2026-3282
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vips
Debian:12
 before 8.14.1-3+deb12u3, plus listed versions
8.14.1-38.14.1-3+deb12u18.14.1-3+deb12u2
8.14.1-3+deb12u3
vips
Debian:13
 before 8.16.1-1+deb13u1, plus listed versions
8.16.1-1
8.16.1-1+deb13u1
vips
Debian:14
 before 8.18.0-3, plus listed versions
8.16.1-18.16.1-28.17.3-18.17.3-28.18.0-18.18.0-2
8.18.0-3
vips
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.40.6-2ubuntu28.0.2-28.2.1-18.2.2-18.2.2-1ubuntu0.1~esm1
 None known
vips
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.4.5-1build18.4.5-1ubuntu0.1~esm1
 None known
vips
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
8.7.4-1build18.8.3-38.8.3-3ubuntu18.9.0-18.9.0-1build18.9.1-18.9.1-28.9.1-2ubuntu0.1~esm1
 None known
vips
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
8.10.5-2ubuntu18.11.4-28.12.1-18.12.1-1build18.12.1-1ubuntu0.1~esm18.12.1-1ubuntu0.1~esm2
 None known
vips
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
8.14.3-18.14.5-18.15.0-18.15.0-28.15.1-1
Show 4 moreShow less
8.15.1-1build18.15.1-1.1build38.15.1-1.1build48.15.1-1.1ubuntu0.1~esm1
 None known
vips
Ubuntu:25.10
 All versions, plus listed versions
8.16.0-2build18.16.1-1
 None known
vips
Ubuntu:26.10
 All versions, plus listed versions
8.18.0-1build18.18.3-18.18.4-18.18.5-1
 None known
vips
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
8.16.1-18.16.1-28.17.3-28.18.0-18.18.0-1build18.18.0-1ubuntu0.1~esm1
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open