MEDIUM
libvips csvload.c vips_foreign_load_csv_build heap-based overflow
Published Feb 25, 2026
4.8
MEDIUMCVSS 4.0
EPSS 0.23%
Description
A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3ab458a25e0e261cbd1788474bbc763f7435780. It is advisable to implement a patch to correct this issue.
Affected products
-
- Version 8.0StatusaffectedConstraints-
- Version 8.1StatusaffectedConstraints-
- Version 8.10StatusaffectedConstraints-
- Version 8.11StatusaffectedConstraints-
- Version 8.12StatusaffectedConstraints-
- Version 8.13StatusaffectedConstraints-
- Version 8.14StatusaffectedConstraints-
- Version 8.15StatusaffectedConstraints-
- Version 8.16StatusaffectedConstraints-
- Version 8.17StatusaffectedConstraints-
- Version 8.18.0StatusaffectedConstraints-
- Version 8.2StatusaffectedConstraints-
- Version 8.3StatusaffectedConstraints-
- Version 8.4StatusaffectedConstraints-
- Version 8.5StatusaffectedConstraints-
- Version 8.6StatusaffectedConstraints-
- Version 8.7StatusaffectedConstraints-
- Version 8.8StatusaffectedConstraints-
- Version 8.9StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Libvips | Libvips | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (8)
- https://github.com/libvips/libvips/ product
- https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435780 patch
- https://github.com/libvips/libvips/issues/4874 issue-trackingExploitIssue TrackingVendor Advisory
- https://github.com/libvips/libvips/issues/4874#issue-3943617697 exploitissue-trackingIssue TrackingVendor Advisory
- https://github.com/libvips/libvips/pull/4894 issue-trackingpatchIssue Tracking
- https://vuldb.com/?ctiid.347653 signaturepermissions-requiredPermissions RequiredVDB Entry
- https://vuldb.com/?id.347653 vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
- https://vuldb.com/?submit.758692 third-party-advisoryThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| https://github.com/libvips/libvips/ | product | |
| https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435780 | patch | |
| https://github.com/libvips/libvips/issues/4874 | issue-trackingExploitIssue TrackingVendor Advisory | |
| https://github.com/libvips/libvips/issues/4874#issue-3943617697 | exploitissue-trackingIssue TrackingVendor Advisory | |
| https://github.com/libvips/libvips/pull/4894 | issue-trackingpatchIssue Tracking | |
| https://vuldb.com/?ctiid.347653 | signaturepermissions-requiredPermissions RequiredVDB Entry | |
| https://vuldb.com/?id.347653 | vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry | |
| https://vuldb.com/?submit.758692 | third-party-advisoryThird Party AdvisoryVDB Entry |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Feb 25, 2026
Updated Feb 25, 2026
Reserved Feb 24, 2026
Link CVE-2026-3147
CISA Vulnrichment
Updated Feb 25, 2026