CVE-2026-3283

A vulnerability has been found in libvips 8.19.0. This issue affects the function vipsextractbandbuild of the file libvips/conversion/extract.c. The manipulation of the argument extractband leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.

References

Affected packages

Git / github.com/libvips/libvips

Affected ranges

Type: GIT
Repo: https://github.com/libvips/libvips
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

24795bb3d19d84f7b6f5ed86451ad556c8f2fe70

Affected versions

v7.*

v7.28.0

v7.30.0

v8.*

v8.0-beta

v8.1

v8.10.0

v8.10.0-beta1

v8.10.0-beta2

v8.10.0-rc1

v8.10.0-rc2

v8.10.1

v8.10.2

v8.10.3

v8.10.4

v8.10.5

v8.10.6

v8.10.6-beta

v8.10.6-beta2

v8.11

v8.11.0

v8.11.0-rc1

v8.11.1

v8.11.2

v8.11.3

v8.11.4

v8.12.0

v8.12.0-rc1

v8.12.1

v8.12.2

v8.13.0

v8.13.0-pre1

v8.13.0-rc1

v8.13.0-rc2

v8.13.1

v8.13.2

v8.13.3

v8.14.0

v8.14.0-rc1

v8.14.1

v8.14.2

v8.14.3

v8.14.4

v8.14.5

v8.15.0

v8.15.0-rc1

v8.15.0-rc2

v8.15.1

v8.15.2

v8.15.2a

v8.15.3

v8.15.4

v8.15.4-rc1

v8.15.5

v8.15.5-rc1

v8.16.0

v8.16.0-rc1

v8.16.0-rc2

v8.16.1

v8.17.0

v8.17.0-rc1

v8.17.0-test1

v8.17.0-test2

v8.17.0-test3

v8.17.0-test4

v8.17.1

v8.17.2

v8.17.3

v8.18.0

v8.18.0-alpha1

v8.18.0-alpha2

v8.18.0-rc1

v8.18.0-rc2

v8.18.0-rc3

v8.2.2

v8.2.3

v8.3.0

v8.4.2

v8.5.1

v8.5.2

v8.5.3

v8.5.4

v8.5.5

v8.5.6

v8.5.7

v8.5.8

v8.5.9

v8.6.0

v8.6.0-alpha1

v8.6.0-alpha2

v8.6.0-alpha3

v8.6.0-alpha4

v8.6.0-alpha5

v8.6.0-beta1

v8.6.0-beta2

v8.6.1

v8.6.2

v8.6.3

v8.6.4

v8.7.0

v8.7.0-alpha1

v8.7.0-alpha2

v8.7.0-rc1

v8.7.0-rc2

v8.7.0-rc3

v8.7.1

v8.7.2

v8.7.3

v8.7.4

v8.8.0

v8.8.0-rc1

v8.8.0-rc2

v8.8.0-rc3

v8.8.1

v8.8.2

v8.8.3

v8.9.0

v8.9.0-alpha1

v8.9.0-beta1

v8.9.0-beta2

v8.9.0-rc1

v8.9.0-rc2

v8.9.0-rc3

v8.9.0-rc4

v8.9.1

v8.9.2

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.19.0"
            }
        ]
    }
]

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-3283-7a2691d3",
        "target": {
            "file": "libvips/conversion/extract.c",
            "function": "vips_extract_area_build"
        },
        "digest": {
            "length": 1004.0,
            "function_hash": "285251679684353671952965590740815848739"
        },
        "signature_version": "v1",
        "source": "https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-3283-801b8f7f",
        "target": {
            "file": "libvips/conversion/extract.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "193071816873117715779369215209029594946",
                "250274461046386427014988688974409676346",
                "175836217097941956702606041183311745872",
                "49981623033314210985944028499907788884",
                "339233191718191705884968584087862497623",
                "194977356878882855530483441890816731424",
                "159947729043730519346083966848637883422",
                "261927180342059039256529976722163682495",
                "173397610903900765118268591886807041346"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-3283-b22eb3ff",
        "target": {
            "file": "libvips/conversion/extract.c",
            "function": "vips_extract_band_build"
        },
        "digest": {
            "length": 587.0,
            "function_hash": "260056398726943000628468038482196278664"
        },
        "signature_version": "v1",
        "source": "https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3283.json"