CVE-2026-3281: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3281 is a heap-based buffer overflow vulnerability in libvips 8.19.0, specifically within the vips_bandrank_build function in libvips/conversion/bandrank.c. The flaw arises when the --index argument is not validated against the runtime number of input images, allowing an out-of-bounds read in vips_bandrank_buffer(). It was reported on February 15, 2026, and publicly disclosed on February 27, 2026, with a patch merged on February 22, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Issue, Feedly).

The root cause is improper bounds checking (CWE-122: Heap-based Buffer Overflow; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). In vips_bandrank_class_init(), the index argument accepts values up to 1,000,000, but vips_bandrank_build() only handles the special value -1 (median) without enforcing index < bandary->n. The unchecked index is then used directly in the FIND_RANK macro within vips_bandrank_buffer() as sort[bandrank->index], where sort is allocated for only bandary->n elements — causing an out-of-bounds heap read when index exceeds the number of input images. Exploitation requires local access with low privileges, and a public proof-of-concept reproducer (using ASAN) was included in the original GitHub issue report (GitHub Issue, Patch Commit).

Successful exploitation can result in information disclosure (reading heap memory beyond the allocated buffer), data corruption (integrity impact), or a denial of service via process abort. The vulnerability is limited to local threat actors with low privileges, constraining its blast radius; however, in environments where libvips processes untrusted image inputs (e.g., web servers using sharp, imgproxy, or similar wrappers), a local attacker or a compromised process could leverage this to leak sensitive heap contents or crash the image processing pipeline (GitHub Issue, Feedly).

A public proof-of-concept exploit is available via the GitHub issue report, demonstrating the vulnerability using an ASAN-instrumented build of libvips 8.19.0. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting a low probability of exploitation in the near term (GitHub Issue, Feedly).

1. Identify target: Locate a system running libvips 8.19.0 with local access, or an application that exposes the bandrank operation with user-controlled parameters.
2. Build or obtain libvips 8.19.0: Compile with ASAN for verification, or use a standard build for exploitation: meson setup build-asan-only -Ddebug=true -Db_sanitize=address && meson compile -C build-asan-only
3. Create minimal input images: Generate two or more small input images using the vips CLI: vips black /tmp/br1.png 4 4 and vips black /tmp/br2.png 4 4
4. Trigger out-of-bounds read: Invoke the bandrank operation with an --index value exceeding the number of input images (e.g., 4 when only 2 images are provided): ./build-asan-only/tools/vips bandrank '/tmp/br1.png /tmp/br2.png' /tmp/br_oob.png --index 4
5. Observe result: The process reads beyond the sort[] heap buffer (sized for bandary->n elements), causing a heap-buffer-overflow. Under ASAN, this aborts with a detailed report; in production, it may silently leak heap data or crash the process (GitHub Issue).

• Process: Unexpected crashes or aborts of processes using libvips (e.g., sharp, imgproxy, vips CLI) with signals such as SIGABRT or SIGSEGV, particularly during bandrank operations.
• Logs: Application logs showing errors from libvips such as "index out of range" (post-patch) or unexplained process terminations during image processing pipelines.
• File System: Presence of core dump files (core.*) in directories where libvips-based applications run, potentially containing heap memory contents.
• Network (indirect): In server-side image processing contexts, unusual or malformed image processing requests containing bandrank operations with anomalously large index values in API parameters or job queues (GitHub Issue, Feedly).

Apply the fix introduced in commit fd28c5463697712cb0ab116a2c55e4f4d92c4088, which adds an explicit bounds check in vips_bandrank_build() to reject any index value greater than or equal to bandary->n. This fix was merged into the libvips:8.18 branch on February 22, 2026, and is included in releases from 8.18.1 onward (latest: v8.18.3 as of June 2026). As a workaround where patching is not immediately possible, restrict local user access to systems running libvips 8.19.0 and apply the principle of least privilege; additionally, consider input validation at the application layer to reject out-of-range index values before they reach the library (Patch Commit, Pull Request, libvips Repo).

The vulnerability was reported by researcher "Niebelungen-D" via the libvips GitHub issue tracker on February 15, 2026, and acknowledged and patched by libvips maintainer "lovell" within a week. The fix was reviewed and approved by contributor "kleisauke" before merging. No significant broader media coverage or notable social media discussion beyond the GitHub thread and automated CVE tracking feeds has been observed (GitHub Issue, Pull Request).