Log in Start free

Vulnerability · Published Feb 27, 2026 · Assigned by VulDB

CVE-2026-3281libvips bandrank.c vips_bandrank_build heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in libvips. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 80.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vips8.14.1-3+deb12u3DEBIAN-CVE-2026-3281
Debian:13vips8.16.1-1+deb13u1DEBIAN-CVE-2026-3281
Debian:14vips8.18.0-3DEBIAN-CVE-2026-3281
Ubuntu:25.10vipsno fix listedUBUNTU-CVE-2026-3281
Ubuntu:26.10vipsno fix listedUBUNTU-CVE-2026-3281

Affected products (as reported)

VendorProductVersions
n/a libvips 8.19.0

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References