CVE-2026-3281
Published: 27 February 2026
Summary
CVE-2026-3281 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Libvips Libvips. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3281 is a heap-based buffer overflow vulnerability in the vips_bandrank_build function within the file libvips/conversion/bandrank.c of the libvips image processing library version 8.19.0. The issue arises from improper handling of the 'index' argument, leading to a buffer overflow condition associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow). The vulnerability was published on 2026-02-27 and carries a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.
Exploitation requires a local attacker with low privileges to manipulate the affected argument, enabling a heap-based buffer overflow. Successful exploitation could result in limited impacts to confidentiality, integrity, and availability, such as partial data disclosure, modification of heap memory, or denial of service through crashes. The attack vector is local-only with low complexity and no user interaction needed.
Mitigation is available via a specific patch commit fd28c5463697712cb0ab116a2c55e4f4d92c4088 in the libvips repository, and users are advised to apply it promptly. Related GitHub resources include the libvips repository, the patch commit, issue #4878, a comment on that issue, and pull request #4895. Notably, a public exploit exists and may be actively used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8985
Vulnerability details
A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is…
more
now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap buffer overflow in image-processing library enables exploitation for privilege escalation (T1068) or client-side code execution via crafted inputs/arguments (T1203); public exploit exists but CVSS indicates only limited impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the published patch (fd28c546...) to remediate the heap buffer overflow in vips_bandrank_build before exploitation occurs.
Mandates validation of the 'index' argument to enforce buffer bounds and eliminate the root cause of the CWE-119/122 overflow.
Requires memory-protection mechanisms (e.g., ASLR, guard pages) that can block successful exploitation of the heap overflow even if the vulnerable code path is reached.