CVE-2026-3283: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3283 is a signed integer overflow leading to an out-of-bounds read vulnerability in libvips 8.19.0, specifically in the vips_extract_band_build function within libvips/conversion/extract.c. Reported by researcher Niebelungen-D on February 15, 2026, and publicly disclosed on February 27, 2026, the flaw allows a locally authenticated low-privileged attacker to bypass bounds validation and trigger an out-of-bounds memory read. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, GitHub Issue).

The root cause is a signed integer overflow (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the bounds check within vips_extract_band_build(). The check if (extract->band + extract->n > bands) uses signed integer arithmetic; when attacker-controlled values near INT_MAX are supplied (e.g., via --vips-max-coord 2147483647), the addition wraps to a negative value, bypassing the validation. The unchecked values are then used directly in pointer arithmetic in vips_extract_band_buffer() as p = in[0] + extract->band * es, computing an invalid base pointer that is subsequently dereferenced in a copy loop, producing an out-of-bounds read and ASAN-detected SEGV crash. The fix (commit 24795bb) changes the comparison to use unsigned 64-bit arithmetic ((guint64) extract->band + extract->n > bands) to prevent overflow (GitHub Issue, Patch Commit).

Successful exploitation allows a locally authenticated attacker with low privileges to read memory beyond intended buffer boundaries, resulting in information disclosure of potentially sensitive in-memory data. The vulnerability also causes a crash (SEGV) in the affected process, impacting availability. There is no integrity impact, and lateral movement potential is limited given the local-only attack vector (Feedly, GitHub Issue).

A proof-of-concept exploit has been publicly disclosed via the GitHub issue tracker, demonstrating the vulnerability using the standard vips CLI tool with crafted arguments. The EPSS score is approximately 0.012% (0.000120), indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Issue).

1. Prerequisite: Obtain local access to a system running libvips 8.19.0 with a low-privileged user account.
2. Build or obtain the vulnerable binary: Confirm the installed libvips version is 8.19.0 (unpatched). Optionally build with ASAN for verification: meson setup build-asan-only -Ddebug=true -Db_sanitize=address && meson compile -C build-asan-only.
3. Prepare a valid input image: Create a minimal valid vips image using the CLI: ASAN_OPTIONS=detect_leaks=0 ./build-asan-only/tools/vips black /tmp/extract_band_in.v 1 1.
4. Trigger the overflow: Invoke the extract_band operation with values near INT_MAX and an elevated --vips-max-coord to bypass the signed bounds check:

ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1 \
LSAN_OPTIONS=detect_leaks=0 \
./build-asan-only/tools/vips --vips-max-coord 2147483647 \
extract_band /tmp/extract_band_in.v /tmp/extract_band_out.v 2147483647 --n 2147483647

5. Observe the result: The signed addition extract->band + extract->n overflows to a negative value, bypassing the range check. The invalid pointer is dereferenced in vips_extract_band_buffer() at extract.c:378, producing an out-of-bounds read (SEGV/ASAN crash) and potentially exposing adjacent memory contents (GitHub Issue).

• Process: Unexpected crashes or SEGV signals from processes invoking libvips extract_band operations; core dumps originating from vips_extract_band_buffer in extract.c:378.
• Logs: Application or system logs showing abnormal termination of libvips-based services (e.g., image processing pipelines using sharp, imgproxy, or similar); ASAN output referencing vips_extract_band_buffer if debug builds are in use.
• Command Line: Audit logs (e.g., auditd) showing invocations of the vips CLI tool with --vips-max-coord 2147483647 and extract_band with arguments near INT_MAX (2147483647) (GitHub Issue).

Apply patch commit 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70, which changes the bounds check in vips_extract_band_build() and vips_extract_area_build() to use unsigned 64-bit arithmetic, preventing signed integer overflow. This fix was merged into the libvips:8.18 branch via PR #4887 on February 19, 2026. Organizations should update to a patched release (8.18.x containing this fix or later) and restrict local user access to systems running vulnerable libvips instances as an interim measure (Patch Commit, PR #4887).

The vulnerability was reported by researcher Niebelungen-D directly to the libvips project via GitHub, and the maintainer (lovell) responded promptly, merging a fix within four days of the report. The issue received routine coverage from automated CVE tracking services and vulnerability databases. No significant broader media coverage or notable security researcher commentary beyond the GitHub thread has been identified (GitHub Issue, PR #4887).