CVE-2026-3281

A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is named fd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a patch to address this issue.

• CWE-119
• CWE-122

• https://github.com/libvips/libvips/Product
• https://github.com/libvips/libvips/commit/fd28c5463697712cb0ab116a2c55e4f4d92c4088Patch
• https://github.com/libvips/libvips/issues/4878Exploit, Issue Tracking, Vendor Advisory
• https://github.com/libvips/libvips/issues/4878#issue-3944209102Exploit, Issue Tracking, Vendor Advisory
• https://github.com/libvips/libvips/pull/4895Issue Tracking, Patch
• https://vuldb.com/?ctiid.348010Permissions Required, VDB Entry
• https://vuldb.com/?id.348010Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.758861Third Party Advisory, VDB Entry

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32803Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.…3.3
• CVE-2026-32804Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…8.1
• CVE-2026-32805Romeo gives the capability to reach high code coverage of Go…7.5
• CVE-2026-32806dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32807dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32808pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-32810Halloy is an IRC application written in Rust. In versions on…5.5
• CVE-2026-32811Heimdall is a cloud native Identity Aware Proxy and Access C…7.5
• CVE-2026-32812Admidio is an open-source user management solution. In versi…6.8
• CVE-2026-32813Admidio is an open-source user management solution. Versions…8
• CVE-2026-32814libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32815SiYuan is a personal knowledge management system. In version…7.5