CVE-2026-3147: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3147 is a heap-based buffer overflow vulnerability in libvips affecting the vips_foreign_load_csv_build() function in libvips/foreign/csvload.c. It impacts libvips versions up to and including 8.18.0 and was reported on February 15, 2026, with a patch merged on February 21, 2026, and publicly disclosed on February 25, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Issue, Feedly).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119, CWE-122 — Heap-based Buffer Overflow). In vips_foreign_load_csv_build(), the whitespace and separator parameters are iterated character by character, and each character is cast to int and used as an array index into whitemap[] and sepmap[] (256-element arrays). On platforms where char is signed, UTF-8 bytes with values ≥ 0x80 produce negative integer values when cast to int, causing writes at negative offsets before the array's allocated heap region and corrupting adjacent memory. An attacker can trigger this by supplying a non-ASCII string (e.g., an emoji like 😀) as the --whitespace or --separator argument to any application invoking the libvips CSV loader. The fix (commit b3ab458) adds an ASCII validation check using g_str_is_ascii() before processing these parameters (GitHub Issue, Patch Commit, PR #4894).

Successful exploitation can result in heap memory corruption, potentially leading to disclosure of sensitive information from process memory, modification of memory contents, and denial of service (crash) of the affected application. The attack is local and requires low privileges, limiting its scope to processes that invoke libvips CSV loading with attacker-controlled whitespace or separator parameters. Lateral movement potential is low given the local attack vector, but applications exposing libvips CSV processing to user-supplied input (e.g., image processing pipelines) may be at elevated risk (GitHub Issue, Feedly).

A proof-of-concept exploit was publicly disclosed alongside the bug report on GitHub, demonstrating the heap-buffer-overflow using AddressSanitizer (ASAN) on Ubuntu 22.04 with a crafted --whitespace argument containing a multi-byte UTF-8 character (GitHub Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify target: Locate a system running libvips ≤ 8.18.0 where the CSV loader is accessible, either via the vips command-line tool or an application that exposes whitespace/separator parameters to user input.
2. Prepare a CSV file: Create a minimal valid CSV file (e.g., printf '1,2\n3,4\n' > /tmp/test.csv).
3. Craft malicious argument: Prepare a non-ASCII string containing UTF-8 bytes ≥ 0x80 (e.g., an emoji like 😀) to use as the --whitespace or --separator parameter.
4. Trigger the overflow: Execute the vips CSV loader with the crafted argument: vips csvload --whitespace='😀' /tmp/test.csv /tmp/out.v. On platforms with signed char, the multi-byte UTF-8 sequence produces negative integer indices, writing out-of-bounds on the heap.
5. Achieve impact: The out-of-bounds write corrupts adjacent heap memory, potentially causing a crash (DoS) or, in a more controlled scenario, enabling memory disclosure or code execution depending on heap layout (GitHub Issue, Patch Commit).

• Process: Unexpected crashes or segmentation faults in processes using libvips CSV loading functionality; ASAN reports of heap-buffer-overflow in vips_foreign_load_csv_build() at csvload.c:135.
• Logs: Application error logs showing libvips crashes or abnormal termination when processing CSV files with non-ASCII whitespace or separator parameters.
• File System: Presence of crafted CSV files or scripts passing non-ASCII characters as --whitespace or --separator arguments to libvips-based tools.
• Network: If libvips is used in a web service context, HTTP requests supplying non-ASCII characters in parameters mapped to whitespace or separator fields of the CSV loader (GitHub Issue).

Apply the patch introduced in commit b3ab458a25e0e261cbd1788474bbc763f7435780, which adds an ASCII validation check (g_str_is_ascii()) for whitespace and separator parameters before array indexing occurs (Patch Commit, PR #4894). Users should upgrade to a libvips release that includes this fix (post-8.18.0 patch release). As a workaround prior to patching, restrict local file access privileges for applications using libvips and validate that whitespace and separator inputs contain only ASCII characters before passing them to the library (Feedly).

The vulnerability was reported by researcher Niebelungen-D via the libvips GitHub issue tracker on February 15, 2026, with a detailed ASAN report and reproduction steps. Maintainer lovell acknowledged the issue and merged a fix within six days. The fix was reviewed and approved by contributor kleisauke. No significant broader media coverage or notable social media discussion beyond the GitHub thread has been identified (GitHub Issue, PR #4894).