CVE-2026-3281: libvips bandrank.c vips_bandrank_build heap-based overflow
A vulnerability was detected in libvips 8.19.0. This affects the function vipsbandrankbuild of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3281?
CVE-2026-3281 is classified as a high severity vulnerability due to the potential for heap-based buffer overflow.
How do I fix CVE-2026-3281?
To fix CVE-2026-3281, you should update libvips to the latest version that addresses this vulnerability.
What versions of libvips are affected by CVE-2026-3281?
CVE-2026-3281 affects libvips version 8.19.0.
What are the potential consequences of exploiting CVE-2026-3281?
Exploiting CVE-2026-3281 may lead to arbitrary code execution due to heap-based buffer overflow.
In which function is CVE-2026-3281 located?
CVE-2026-3281 is found in the vips_bandrank_build function within the file bandrank.c.