CVE-2026-3146: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3146 is a NULL pointer dereference vulnerability in libvips affecting all versions up to and including 8.18.0. The flaw resides in the vips_foreign_load_matrix_header() function within libvips/foreign/matrixload.c, where a NULL return value from vips_sbuf_get_line_copy() (triggered by an empty or malformed matrix file) is passed unchecked to parse_matrix_header(), which immediately dereferences it. The vulnerability was reported on February 15, 2026, patched on February 19, 2026, and publicly disclosed on February 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Issue, GitHub Commit).

The root cause is a missing NULL check (CWE-476: NULL Pointer Dereference) in vips_foreign_load_matrix_header(). When processing an empty or header-less matrix file, vips_sbuf_get_line_copy() returns NULL, and this pointer is passed directly to parse_matrix_header(), which calls strchr(line, '\r') at line 122 — immediately dereferencing the NULL pointer and causing a segmentation fault. The attack requires local access and low privileges; an attacker must be able to supply a crafted (e.g., empty) .mat file to an application using libvips for matrix loading. A detailed ASAN stack trace demonstrating the crash was included in the original bug report, confirming the crash path through parse_matrix_header() → vips_foreign_load_matrix_header() (GitHub Issue, GitHub Commit).

Successful exploitation causes an application crash (denial of service) in any process that uses libvips to load matrix files. There is no confidentiality or integrity impact — the vulnerability is limited to availability, as the affected process terminates abnormally upon encountering an empty or malformed matrix input. In server-side image processing pipelines (e.g., web applications using sharp, imgproxy, or similar libvips-backed tools), a remote attacker who can supply crafted matrix files could repeatedly crash the image processing service, leading to sustained unavailability (GitHub Issue, Feedly).

A proof-of-concept is publicly available via the GitHub issue report, demonstrating that an empty file (/tmp/empty.mat) is sufficient to trigger the crash. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the wild. The vulnerability is detectable by Nessus (plugin ID 299986) (GitHub Issue, Feedly).

1. Identify target: Locate a system or application that uses libvips ≤ 8.18.0 for matrix file processing (e.g., a web service accepting image uploads, or a local image processing tool).
2. Create malicious input: Craft an empty or header-less matrix file — as simple as touch /tmp/empty.mat or echo -n > /tmp/empty.mat.
3. Supply the file: Pass the crafted file to the vulnerable libvips matrix loader, either via a command-line tool (vips matrixload /tmp/empty.mat /tmp/out.v) or by uploading it to an application that internally invokes vips_foreign_load_matrix_header().
4. Trigger crash: The vips_sbuf_get_line_copy() call returns NULL for the empty input; parse_matrix_header() dereferences it at strchr(line, '\r'), causing a SIGSEGV and process termination.
5. Achieve denial of service: The target application crashes or becomes unavailable; in automated pipelines, repeated submission of such files can cause persistent service disruption (GitHub Issue).

• Logs: Application crash logs or core dumps referencing parse_matrix_header or vips_foreign_load_matrix_header in the stack trace; ASAN output showing DEADLYSIGNAL / SEGV on unknown address 0x000000000000.
• Process: Unexpected termination of libvips-backed processes (e.g., sharp, imgproxy, vips CLI tools) with signal SIGSEGV (signal 11).
• File System: Presence of empty or near-empty .mat files in upload directories or temporary processing directories used by image processing services.
• Network: Repeated upload requests containing zero-byte or minimal .mat files to image processing endpoints, potentially indicating automated crash attempts (GitHub Issue).

Upgrade libvips to a version newer than 8.18.0 that includes commit d4ce337c76bff1b278d7085c3c4f4725e3aa6ece, which adds a NULL check in vips_foreign_load_matrix_header() before passing the line pointer to parse_matrix_header(). Chainguard and Wolfi package maintainers have already issued remediated packages. Where immediate patching is not feasible, restrict local user access to systems running vulnerable libvips versions and implement input validation to reject empty or malformed matrix files before they reach the libvips loader (GitHub PR, GitHub Commit).

The vulnerability was reported by researcher "Niebelungen-D" via the libvips GitHub issue tracker on February 15, 2026, and promptly addressed by libvips maintainer "lovell" with a patch merged on February 19, 2026. The fix was reviewed and approved by contributor "kleisauke" before merging. No significant broader media coverage or social media discussion has been observed, consistent with the vulnerability's limited scope and medium severity (GitHub Issue, GitHub PR).