CVE-2026-3284: libvips extract.c vips_extract_area_build integer overflow
A vulnerability was found in libvips 8.19.0. Impacted is the function vipsextractareabuild of the file libvips/conversion/extract.c. The manipulation of the argument extractarea results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3284?
The severity of CVE-2026-3284 is considered high due to the potential for integer overflow vulnerabilities that could be exploited.
How do I fix CVE-2026-3284?
To fix CVE-2026-3284, upgrade to a patched version of libvips that is beyond version 8.19.0.
What are the potential impacts of CVE-2026-3284?
CVE-2026-3284 could lead to denial of service or arbitrary code execution due to the integer overflow.
Who is affected by CVE-2026-3284?
CVE-2026-3284 affects users running libvips version 8.19.0.
What is the nature of CVE-2026-3284?
CVE-2026-3284 is an integer overflow vulnerability in the function vips_extract_area_build found in extract.c of libvips.