CVE-2026-3282: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3282 is an out-of-bounds read vulnerability in libvips 8.19.0 affecting the vips_unpremultiply_build() function in libvips/conversion/unpremultiply.c. The flaw was reported on February 15, 2026 by researcher Niebelungen-D via GitHub issue #4881, with a patch merged on February 19, 2026 (GitHub Issue, GitHub PR). It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 1.9 (Low), reflecting its local-only attack vector (Feedly).

The root cause is improper input validation (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in vips_unpremultiply_build(). The alpha_band argument accepts values from 0 to 100,000,000 but is never validated against the actual number of image bands (in->Bands). When a user supplies an alpha_band value exceeding the image's band count, the UNPRE_MANY macro in vips_unpremultiply_gen() directly dereferences p[alpha_band] and writes to q[alpha_band], causing a heap-buffer-overflow (GitHub Issue). The fix adds a bounds check: if alpha_band >= in->Bands, the function returns an error (GitHub Commit). Exploitation requires local access with low privileges and no user interaction.

Successful exploitation allows a local attacker with low privileges to read memory outside the intended heap buffer, potentially exposing sensitive data from the application's memory space. The vulnerability has high confidentiality and availability impact under CVSS v3.1 (the out-of-bounds read can also cause application crashes), but no integrity impact. Because the attack is local-only and requires no user interaction, the risk of broad lateral movement is limited, though applications processing untrusted images via libvips (e.g., web servers using sharp or imgproxy) could be exposed if an attacker has local system access (Feedly, GitHub Issue).

A proof-of-concept exploit has been publicly disclosed via the GitHub issue report, including a full ASAN-confirmed reproduction case (GitHub Issue). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of widespread exploitation in the near term (Feedly). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is detectable by Nessus (detection ID 300282).

1. Gain local access: Obtain a local account with low privileges on a system running libvips 8.19.0.
2. Prepare a crafted image: Create a standard multi-band image (e.g., a 3-band PNG) using the vips black command: vips black /tmp/up3.png 8 8 --bands 3
3. Invoke the vulnerable operation: Run the unpremultiply operation with an --alpha-band value exceeding the image's band count (e.g., 10 for a 3-band image): vips unpremultiply /tmp/up3.png /tmp/out.png --alpha-band 10
4. Trigger out-of-bounds read: The vips_unpremultiply_gen() function enters the UNPRE_MANY code path and reads p[10] on a 3-band image buffer, accessing memory beyond the allocated heap region.
5. Observe memory disclosure or crash: The out-of-bounds read exposes heap memory contents adjacent to the image buffer, or causes an application crash (heap-buffer-overflow as confirmed by ASAN) (GitHub Issue).

• Process: Unexpected invocations of vips unpremultiply with unusually large --alpha-band values (e.g., values exceeding the number of bands in the input image).
• Logs: Application crash logs or core dumps referencing vips_unpremultiply_gen() in libvips/conversion/unpremultiply.c around line 208; ASAN reports showing heap-buffer-overflow in the same function.
• File System: Presence of ASAN-instrumented libvips binaries (e.g., built with -Db_sanitize=address) in non-standard directories, which may indicate reconnaissance or exploit development activity (GitHub Issue).

Upgrade libvips beyond version 8.19.0 to a release incorporating the fix from commit 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91, which adds a bounds check rejecting alpha_band values outside [0, in->Bands - 1] (GitHub Commit, GitHub PR). The patch was merged into the 8.18 branch on February 19, 2026. As a workaround where patching is not immediately possible, restrict local system access to trusted users only and avoid exposing the unpremultiply operation with user-controlled alpha_band parameters in application code.

The vulnerability was reported by security researcher Niebelungen-D, who also identified related issues in libvips (extract bounds checking, matrixload input validation) around the same period, suggesting a focused audit of the library (GitHub Issue). The libvips maintainer (lovell) responded promptly, merging the fix within four days of the report. The issue was noted on Bluesky via automated CVE tracking accounts and indexed by several vulnerability aggregators shortly after disclosure (Feedly).