Cyber Posture

CVE-2026-3281

MediumPublic PoC

Published: 27 February 2026

Published
27 February 2026
Modified
02 March 2026
KEV Added
Patch
CVSS Score 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0001 2.9th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3281 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Libvips Libvips. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

addresses: CWE-119

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Local heap buffer overflow in image-processing library enables exploitation for privilege escalation (T1068) or client-side code execution via crafted inputs/arguments (T1203); public exploit exists but CVSS indicates only limited impact.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is…

more

now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.

Deeper analysisAI

CVE-2026-3281 is a heap-based buffer overflow vulnerability in the vips_bandrank_build function within the file libvips/conversion/bandrank.c of the libvips image processing library version 8.19.0. The issue arises from improper handling of the 'index' argument, leading to a buffer overflow condition associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow). The vulnerability was published on 2026-02-27 and carries a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.

Exploitation requires a local attacker with low privileges to manipulate the affected argument, enabling a heap-based buffer overflow. Successful exploitation could result in limited impacts to confidentiality, integrity, and availability, such as partial data disclosure, modification of heap memory, or denial of service through crashes. The attack vector is local-only with low complexity and no user interaction needed.

Mitigation is available via a specific patch commit fd28c5463697712cb0ab116a2c55e4f4d92c4088 in the libvips repository, and users are advised to apply it promptly. Related GitHub resources include the libvips repository, the patch commit, issue #4878, a comment on that issue, and pull request #4895. Notably, a public exploit exists and may be actively used.

Details

CWE(s)

Affected Products

libvips
libvips
8.19.0

CVEs Like This One

CVE-2026-3147Same product: Libvips Libvips
CVE-2026-3145Same product: Libvips Libvips
CVE-2026-3283Same product: Libvips Libvips
CVE-2026-3282Same product: Libvips Libvips
CVE-2025-2757Shared CWE-119, CWE-122
CVE-2026-2776Shared CWE-119
CVE-2025-7208Shared CWE-119, CWE-122
CVE-2025-21411Shared CWE-122
CVE-2026-6296Shared CWE-122
CVE-2025-1179Shared CWE-119

References