CVE-2026-3284
libvips extract.c vips_extract_area_build integer overflow
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_area results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. It is advisable to implement a patch to correct this issue.
| CWE | CWE-190 CWE-189 |
| Vendor | n/a |
| Product | libvips |
| Published | Feb 27, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a libvips
Be the first to know when new low vulnerabilities affecting n/a libvips are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / libvips
8.19.0
References
vuldb.com: https://vuldb.com/?id.348013 vuldb.com: https://vuldb.com/?ctiid.348013 vuldb.com: https://vuldb.com/?submit.758864 github.com: https://github.com/libvips/libvips/issues/4879 github.com: https://github.com/libvips/libvips/pull/4887 github.com: https://github.com/libvips/libvips/issues/4879#issue-3944211794 github.com: https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70 github.com: https://github.com/libvips/libvips/
Credits
🔍 Niebelungen (VulDB User)