Log in Start free

Vulnerability · Published Feb 25, 2026 · Assigned by VulDB

CVE-2026-3147libvips csvload.c vips_foreign_load_csv_build heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in libvips. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3ab458a25e0e261cbd1788474bbc763f7435780. It is advisable to implement a patch to correct this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vips8.14.1-3+deb12u3DEBIAN-CVE-2026-3147
Debian:13vips8.16.1-1+deb13u1DEBIAN-CVE-2026-3147
Debian:14vips8.18.0-3DEBIAN-CVE-2026-3147
Ubuntu:25.10vipsno fix listedUBUNTU-CVE-2026-3147
Ubuntu:26.10vipsno fix listedUBUNTU-CVE-2026-3147

Affected products (as reported)

VendorProductVersions
n/a libvips 8.08.18.28.38.48.58.68.7

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References