CVE-2026-3145 - libvips matrixload.c vips_foreign_load_matrix_header memory corruption

Back Back to CVE browser

MEDIUM

libvips matrixload.c vips_foreign_load_matrix_header memory corruption

Published Feb 25, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.21%

Description

A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. This patch is called d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. A patch should be applied to remediate this issue.

Affected products

Vendor Libvips Product Libvips Default
n/a
- Version
  8.0
  Status
  affected
  Constraints
  -
- Version
  8.1
  Status
  affected
  Constraints
  -
- Version
  8.10
  Status
  affected
  Constraints
  -
- Version
  8.11
  Status
  affected
  Constraints
  -
- Version
  8.12
  Status
  affected
  Constraints
  -
- Version
  8.13
  Status
  affected
  Constraints
  -
- Version
  8.14
  Status
  affected
  Constraints
  -
- Version
  8.15
  Status
  affected
  Constraints
  -
- Version
  8.16
  Status
  affected
  Constraints
  -
- Version
  8.17
  Status
  affected
  Constraints
  -
- Version
  8.18.0
  Status
  affected
  Constraints
  -
- Version
  8.2
  Status
  affected
  Constraints
  -
- Version
  8.3
  Status
  affected
  Constraints
  -
- Version
  8.4
  Status
  affected
  Constraints
  -
- Version
  8.5
  Status
  affected
  Constraints
  -
- Version
  8.6
  Status
  affected
  Constraints
  -
- Version
  8.7
  Status
  affected
  Constraints
  -
- Version
  8.8
  Status
  affected
  Constraints
  -
- Version
  8.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Libvips

n/a

Version	Status	Constraints
8.0	affected	-
8.1	affected	-
8.10	affected	-
8.11	affected	-
8.12	affected	-
8.13	affected	-
8.14	affected	-
8.15	affected	-
8.16	affected	-
8.17	affected	-
8.18.0	affected	-
8.2	affected	-
8.3	affected	-
8.4	affected	-
8.5	affected	-
8.6	affected	-
8.7	affected	-
8.8	affected	-
8.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-119

Buffer Overflow

References (8)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8586
Advisory
https://github.com/libvips/libvips/
product
https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
patch
https://github.com/libvips/libvips/issues/4876
issue-trackingExploitIssue TrackingVendor Advisory
https://github.com/libvips/libvips/pull/4888
issue-trackingpatchIssue Tracking
https://vuldb.com/?ctiid.347651
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.347651
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.758690
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8586		Advisory
https://github.com/libvips/libvips/		product
https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece		patch
https://github.com/libvips/libvips/issues/4876		issue-trackingExploitIssue TrackingVendor Advisory
https://github.com/libvips/libvips/pull/4888		issue-trackingpatchIssue Tracking
https://vuldb.com/?ctiid.347651		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.347651		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.758690		third-party-advisoryThird Party AdvisoryVDB Entry