CVE-2026-3145
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Feb 25, 2026
CISA due date
—
The record
A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. This patch is called d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. A patch should be applied to remediate this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | libvips | 0 | 8.18.0-r3 |
| Chainguard | libvips-8.17 | 0 | 8.17.3-r1 |
| Chainguard | libvips-dev | 0 | 8.18.0-r3 |
| Chainguard | libvips-doc | 0 | 8.18.0-r3 |
| Wolfi | libvips | 0 | 8.18.0-r3 |
| Wolfi | libvips-8.17 | 0 | 8.17.3-r1 |
| Wolfi | libvips-dev | 0 | 8.18.0-r3 |
| Wolfi | libvips-doc | 0 | 8.18.0-r3 |
Related vulnerabilities
- CVE-2026-3147 A vulnerability was found in libvips up to 8.18.0. Also affects libvips
- CVE-2026-3146 A vulnerability has been found in libvips up to 8.18.0. Also affects libvips
- CVE-2026-2913 A vulnerability was determined in libvips up to 8.19.0. Also affects libvips
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-119