CVE-2026-3282

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-328207.5dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328218.1dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328226.1dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328234.3dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328247.3dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328257.3dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the mod CVE-2026-328284.9Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 throu CVE-2026-328297.5lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ CVE-2026-32837.1A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/ext CVE-2026-328338.8Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers t CVE-2026-328347.5Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code CVE-2026-328366.2dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vuln