Read the docs
TI-2026-02718 Aliases CVE-2026-3146GHSA-v5rp-3mcx-fr73

libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference

Priority MEDIUM 55CWE-404Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—libvips8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18.0—No fix listedCNA
  • libvips Vendor— Affected 8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*up to 8.18.0Vulnerablelibvips
  • cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:* Versions up to 8.18.0 Vulnerable ·libvips

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3146
  2. 2026-10-03 Alias added: GHSA-v5rp-3mcx-fr73

References

Exploit 1

Patch 2

Other 1

  • TI-2026-02835 libvips extract.c vips_extract_area_build integer overflow CVSS 4.0MEDIUM 4.8
  • TI-2026-02834 libvips extract.c vips_extract_band_build out-of-bounds CVSS 4.0MEDIUM 4.8
  • TI-2026-02833 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds CVSS 4.0MEDIUM 4.8
  • TI-2026-02832 libvips bandrank.c vips_bandrank_build heap-based overflow CVSS 4.0MEDIUM 4.8
  • TI-2026-02719 libvips csvload.c vips_foreign_load_csv_build heap-based overflow CVSS 4.0MEDIUM 4.8
  • TI-2026-02717 libvips matrixload.c vips_foreign_load_matrix_header memory corruption CVSS 4.0MEDIUM 4.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences