Bug 2442525 (CVE-2026-3146) - CVE-2026-3146 libvips: libvips: Local denial of service due to null pointer dereference
Summary: CVE-2026-3146 libvips: libvips: Local denial of service due to null pointer d...
Keywords:
Status: NEW
Alias: CVE-2026-3146
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2442676 2442677
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-02-25 04:01 UTC by OSIDB Bzimport
Modified: 2026-02-25 17:13 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-02-25 04:01:31 UTC 
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.
Note You need to log in before you can comment on or make changes to this bug.