Bug 2443250 (CVE-2026-3281) - CVE-2026-3281 libvips: vips: libvips: Memory corruption vulnerability via argument index manipulation in vips_bandrank_build
Summary: CVE-2026-3281 libvips: vips: libvips: Memory corruption vulnerability via arg...
Keywords:
Status: NEW
Alias: CVE-2026-3281
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2443341 2443344
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-02-27 03:01 UTC by OSIDB Bzimport
Modified: 2026-03-02 11:10 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-02-27 03:01:37 UTC 
A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.
Note You need to log in before you can comment on or make changes to this bug.