Every CVE Search/ Get API key

CVE-2026-3283

libvips extract.c vips_extract_band_build out-of-bounds

4.8 MediumFix available

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.24%Up 0.2 points since Feb 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

libvips extract.c vips_extract_band_build out-of-bounds

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-3283
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C
Weakness
CWE-125, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-8990 4.8

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
EUVD-2026-8990
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-93j6-h3cr-cp28 1.9

A vulnerability has been found in libvips 8.19.0. This issue affects the function...

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
GHSA-93j6-h3cr-cp28
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119
Updated
2026-11-02
NVD 1.9

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-3283
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSV 1.9

libvips extract.c vips_extract_band_build out-of-bounds

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-3283
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-3283 7.1

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
DEBIAN-CVE-2026-3283
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-3283 1.9

A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

Record
UBUNTU-CVE-2026-3283
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vips
Debian:12
 before 8.14.1-3+deb12u3, plus listed versions
8.14.1-38.14.1-3+deb12u18.14.1-3+deb12u2
8.14.1-3+deb12u3
vips
Debian:13
 before 8.16.1-1+deb13u1, plus listed versions
8.16.1-1
8.16.1-1+deb13u1
vips
Debian:14
 before 8.18.0-3, plus listed versions
8.16.1-18.16.1-28.17.3-18.17.3-28.18.0-18.18.0-2
8.18.0-3
vips
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.40.6-2ubuntu28.0.2-28.2.1-18.2.2-18.2.2-1ubuntu0.1~esm1
 None known
vips
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.4.5-1build18.4.5-1ubuntu0.1~esm18.4.5-1ubuntu0.1~esm2
 None known
vips
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
8.7.4-1build18.8.3-38.8.3-3ubuntu18.9.0-18.9.0-1build1
Show 4 moreShow less
8.9.1-18.9.1-28.9.1-2ubuntu0.1~esm18.9.1-2ubuntu0.1~esm2
 None known
vips
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
8.10.5-2ubuntu18.11.4-28.12.1-18.12.1-1build18.12.1-1ubuntu0.1~esm18.12.1-1ubuntu0.1~esm28.12.1-1ubuntu0.1~esm3
 None known
vips
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
8.14.3-18.14.5-18.15.0-18.15.0-28.15.1-1
Show 5 moreShow less
8.15.1-1build18.15.1-1.1build38.15.1-1.1build48.15.1-1.1ubuntu0.1~esm18.15.1-1.1ubuntu0.1~esm2
 None known
vips
Ubuntu:25.10
 All versions, plus listed versions
8.16.0-2build18.16.1-1
 None known
vips
Ubuntu:26.10
 All versions, plus listed versions
8.18.0-1build18.18.3-18.18.4-18.18.5-1
 None known
vips
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
8.16.1-18.16.1-28.17.3-28.18.0-18.18.0-1build18.18.0-1ubuntu0.1~esm18.18.0-1ubuntu0.1~esm2
 None known

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-3283 is a medium vulnerability (CVSS 4.8) in Libvips, published February 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in vips 8.14.1-3+deb12u3.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open