Local memory disclosure via unchecked bandrank index
Published Feb 27, 2026 · Updated Feb 27, 2026
Out-of-bounds read in libvips 8.19.0 allows local users to read adjacent process memory through the bandrank operation. vips_bandrank_build accepts an explicit index without checking it against the runtime input count, and vips_bandrank_buffer uses that value to read sort[index] beyond its allocated heap buffer. The user must invoke or expose bandrank with an index at least as large as the input-image count; the demonstrated result is an out-of-bounds read, not code execution.
Summary
What happened
Out-of-bounds read in libvips 8.19.0 allows local users to read adjacent process memory through the bandrank operation. vips_bandrank_build accepts an explicit index without checking it against the runtime input count, and vips_bandrank_buffer uses that value to read sort[index] beyond its allocated heap buffer. The user must invoke or expose bandrank with an index at least as large as the input-image count; the demonstrated result is an out-of-bounds read, not code execution.
The record
- CVE
- CVE-2026-3281
- Published
- Feb 27, 2026
- Updated
- Feb 27, 2026
- Vendor
- libvips
- Product
- libvips
- Classifications
- CWE-119, CWE-122, T1203
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Feb 27, 2026CVE publishedPublication date reported by the CVE source.
- Feb 27, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=8.19.0
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- bandrank out-of-bounds read reproducerproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo