CVE-2026-3284CWE-190

libvips extract.c vips_extract_area_build integer overflow

Medium · published February 27, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_area results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as 24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. It is advisable to implement a patch to correct this issue.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00199 · 9.2th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-02-27T03:02Z
EPSS history
Timeline
  • 27 FEB 03:02Z
    libvips extract.c vips_extract_area_build integer overflow
    cvelistv5