What’s Vulnerable › Vulnerabilities

CVE-2026-3146: libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-25 · updated 2026-06-17
• Weakness: CWE-404

Description

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.

Affected products

• libvips: through 8.18.0

References

• https://github.com/libvips/libvips/
• https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
• https://github.com/libvips/libvips/issues/4875
• https://github.com/libvips/libvips/pull/4888
• https://vuldb.com/?ctiid.347652
• https://vuldb.com/?id.347652
• https://vuldb.com/?submit.758691
• https://github.com/libvips/libvips/issues/4875

Get alerted when CVE-2026-3146 or the next vulnerability affects your stack