CVE-2026-3145: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3145 is a stack buffer overflow (underflow write) vulnerability in libvips up to and including version 8.18.0, caused by a signed/unsigned integer conversion bug in the vips_foreign_load_matrix_file_is_a function within libvips/foreign/matrixload.c. When vips__get_bytes() returns -1 on a read error, the value is stored in an unsigned guint64 variable, wrapping to 18446744073709551615 and causing an out-of-bounds stack write at line[bytes] = '\0'. The vulnerability was reported on February 15, 2026, patched on February 19, 2026, and published on February 25, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Issue, GitHub PR).

The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a signed-to-unsigned integer conversion error. The function vips_foreign_load_matrix_file_is_a() calls vips__get_bytes(), which returns a signed gint64 that can be -1 on read failure; this value was incorrectly stored in an unsigned guint64 bytes variable. The resulting wraparound causes line[bytes] = '\0' to write one byte at a stack address 143 bytes before the line buffer, corrupting adjacent stack variables. The fix in commit d4ce337 changes the declaration of bytes from guint64 to gint64 and adds a null-check guard in vips_foreign_load_matrix_header(). Exploitation requires local access and low privileges; an attacker can trigger the bug by causing libvips to attempt loading a file that produces a read error during format detection (e.g., /proc/self/mem) (GitHub Issue, GitHub Commit).

Successful exploitation can lead to memory corruption on the stack, potentially resulting in data corruption, information disclosure, or denial of service. Because the write corrupts stack memory adjacent to the line buffer (including local variables such as width, height, scale, and offset), an attacker may be able to influence program control flow or cause a crash. The attack is limited to local access with low privileges and does not directly enable remote code execution without additional primitives, but the high CVSS v3.1 score of 7.8 reflects the potential for confidentiality, integrity, and availability impact (GitHub Issue, Feedly).

A proof-of-concept demonstrating the vulnerability via ASAN is publicly available in the GitHub issue report, showing the exact stack-buffer-overflow triggered by running vips copy /proc/self/mem /tmp/out.v against a vulnerable build. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified (GitHub Issue, Feedly).

1. Identify a vulnerable system: Confirm the target has libvips version 8.18.0 or earlier installed and that the attacker has local, low-privileged access to the system.
2. Locate a triggering file: Identify or create a file that causes vips__get_bytes() to return -1 during format detection — for example, a file that is unreadable or produces a read error, such as /proc/self/mem on Linux.
3. Invoke libvips format detection: Execute any libvips operation that triggers the vips_foreign_find_load path, which iterates over all registered loaders including vips_foreign_load_matrix_file_is_a. For example: vips copy /proc/self/mem /tmp/output.v
4. Trigger the integer conversion bug: When vips__get_bytes() returns -1, the value wraps to 18446744073709551615 in the unsigned guint64 bytes variable, causing line[bytes] = '\0' to write one byte at a stack address 143 bytes before the line buffer.
5. Achieve memory corruption: The out-of-bounds write corrupts adjacent stack variables (width, height, scale, offset), potentially causing a crash (denial of service) or, with further exploitation primitives, influencing program control flow (GitHub Issue, GitHub Commit).

• Process: Unexpected crashes or aborts of processes using libvips (e.g., image processing services, web servers using sharp/imgproxy) with stack-related error messages or SIGSEGV/SIGABRT signals.
• Logs: Application logs showing libvips errors related to matrix file loading or format detection failures; ASAN reports referencing matrixload.c:338 in vips_foreign_load_matrix_file_is_a if ASAN-instrumented builds are in use.
• File System: Presence of unusual or crafted files being passed to libvips-based applications, particularly files that would cause read errors during format sniffing (e.g., special device files like /proc/self/mem).
• Network: For web-based image processing services, unusual upload requests containing files designed to trigger read errors during libvips format detection (GitHub Issue).

The fix is available in commit d4ce337c76bff1b278d7085c3c4f4725e3aa6ece, merged into the libvips:8.18 branch on February 19, 2026. Users should upgrade to a libvips release incorporating this patch (any release after February 19, 2026, such as 8.18.1 or later). As a workaround, restrict local system access to trusted users only and avoid exposing libvips-based services to untrusted file inputs. Implementing sandboxing or containerization for applications using libvips can limit the impact of potential exploitation (GitHub PR, GitHub Commit).

The vulnerability was discovered and reported by researcher "Niebelungen-D" via the libvips GitHub issue tracker on February 15, 2026, with a detailed ASAN report and reproduction steps. Maintainer "lovell" acknowledged and fixed the issue promptly, merging the patch within four days. The fix was also adopted by downstream distributions including Wolfi/Chainguard, which remediated CVE-2026-3145 alongside related CVEs in a coordinated update (GitHub Issue, GitHub PR).