CVE-2026-3281
Published: 27 February 2026
Summary
CVE-2026-3281 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Libvips Libvips. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap buffer overflow in image-processing library enables exploitation for privilege escalation (T1068) or client-side code execution via crafted inputs/arguments (T1203); public exploit exists but CVSS indicates only limited impact.
NVD Description
A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is…
more
now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.
Deeper analysisAI
CVE-2026-3281 is a heap-based buffer overflow vulnerability in the vips_bandrank_build function within the file libvips/conversion/bandrank.c of the libvips image processing library version 8.19.0. The issue arises from improper handling of the 'index' argument, leading to a buffer overflow condition associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow). The vulnerability was published on 2026-02-27 and carries a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.
Exploitation requires a local attacker with low privileges to manipulate the affected argument, enabling a heap-based buffer overflow. Successful exploitation could result in limited impacts to confidentiality, integrity, and availability, such as partial data disclosure, modification of heap memory, or denial of service through crashes. The attack vector is local-only with low complexity and no user interaction needed.
Mitigation is available via a specific patch commit fd28c5463697712cb0ab116a2c55e4f4d92c4088 in the libvips repository, and users are advised to apply it promptly. Related GitHub resources include the libvips repository, the patch commit, issue #4878, a comment on that issue, and pull request #4895. Notably, a public exploit exists and may be actively used.
Details
- CWE(s)