Security readout for executives and security teams
Plain-English summary
CVE-2026-3283 affects libvips 8.19.0, an image-processing library. A local user can trigger an out-of-bounds read in band extraction handling. Business impact appears limited: the published CVSS score is medium, requires local access, and indicates low confidentiality impact only. Public exploit information is referenced, but CISA KEV is not listed.
Executive priority
Treat as a normal-priority remediation item unless libvips 8.19.0 is used in shared, multi-user, or untrusted image-processing environments. Prioritize inventory and patch tracking; escalate if local untrusted users can reach affected functionality.
Technical view
The flaw is in libvips/conversion/extract.c, function vips_extract_band_build. Manipulating the extract_band argument can cause an out-of-bounds read, mapped to CWE-119 and CWE-125. CVSS 4.0 is 4.8 with AV:L/PR:L/UI:N and low vulnerable-system confidentiality impact. A patch is identified as commit 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70.
Likely exposure
Exposure is most likely on systems running libvips 8.19.0, especially applications that allow local users or local service contexts to process images through libvips. Remote exposure is not supported by the provided sources.
Exploitation context
The source bundle states exploitation must be local and that exploit details were publicly disclosed. It is not listed in CISA KEV, and the provided sources do not establish active exploitation in the wild.
Researcher notes
Evidence points to an out-of-bounds read, not code execution. The public issue reference is tagged as exploit-related, but this response does not assess exploit reliability. No fixed release number is provided in the bundle; only the patch commit is identified.
Mitigation direction
- Identify systems and applications using libvips 8.19.0.
- Review vendor guidance and the upstream libvips patch commit.
- Apply the upstream patch or a vendor-provided fixed package when available.
- Restrict local access to systems that process untrusted images.
- Monitor libvips issue and pull request threads for release guidance.
Validation and detection
- Inventory installed libvips versions across servers, containers, and application bundles.
- Confirm whether libvips 8.19.0 is present in production images.
- Check package or source history for commit 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70.
- Review applications that expose libvips processing to local users or service accounts.
- Document compensating controls where patching is delayed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3283 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-348012 | libvips extract.c vips_extract_band_build out-of-boundsCVE reference · vdb-entry, technical-description
- VDB-348012 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #758863 | libvips 8.19.0(7fab325d2) Integer Overflow or WraparoundCVE reference · third-party-advisory
- https://github.com/libvips/libvips/issues/4880CVE reference · issue-tracking, exploit
- https://github.com/libvips/libvips/pull/4887CVE reference · issue-tracking, patch
- https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70CVE reference · patch
- https://github.com/libvips/libvips/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.