CVE-2026-3146
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Feb 25, 2026
CISA due date
—
The record
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | libvips | 0 | 8.18.0-r3 |
| Chainguard | libvips-8.17 | 0 | 8.17.3-r1 |
| Chainguard | libvips-dev | 0 | 8.18.0-r3 |
| Chainguard | libvips-doc | 0 | 8.18.0-r3 |
| Wolfi | libvips | 0 | 8.18.0-r3 |
| Wolfi | libvips-8.17 | 0 | 8.17.3-r1 |
| Wolfi | libvips-dev | 0 | 8.18.0-r3 |
| Wolfi | libvips-doc | 0 | 8.18.0-r3 |
Related vulnerabilities
- CVE-2026-3147 A vulnerability was found in libvips up to 8.18.0. Also affects libvips
- CVE-2026-3145 A flaw has been found in libvips up to 8.18.0. Also affects libvips
- CVE-2026-2913 A vulnerability was determined in libvips up to 8.19.0. Also affects libvips
- CVE-2026-109277 ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script… CWE-404
- CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. CWE-404
- CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. CWE-404
- CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. CWE-404
- CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. CWE-404