CVE-2026-2913

Katalog CVE

CVSS 7.0 · High EPSS 0,21%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada libvips. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."

Rincian

Terbit di NVD

22 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libvips/libvips/commit/a56feecbe9ed66521d9647ec9fbcd2546eccd7ee patch
• https://vuldb.com/?id.347222 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.755224 advisory pihak ketiga · vdb entry
• https://github.com/libvips/libvips/issues/4857#issue-3920154326 exploit · issue tracking
• https://github.com/libvips/libvips/issues/4857#issuecomment-3878479322 exploit · issue tracking
• https://github.com/libvips/libvips/ product
• https://github.com/libvips/libvips/issues/4857 issue tracking
• https://vuldb.com/?ctiid.347222 permissions required · vdb entry