CVE-2026-3283

Name	CVE-2026-3283
Description	A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads to out-of-bounds read. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is recommended to deploy a patch.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vips (PTS)	bullseye	8.10.5-2	vulnerable
	bullseye (security)	8.10.5-2+deb11u1	vulnerable
	bookworm, bookworm (security)	8.14.1-3+deb12u2	vulnerable
	trixie	8.16.1-1	vulnerable
	forky, sid	8.18.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vips	source	(unstable)	(unfixed)

Notes

https://github.com/libvips/libvips/issues/4880
https://github.com/libvips/libvips/pull/4887
Fixed by: https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70