CVE-2026-3282

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.

• CWE-119
• CWE-125

• https://github.com/libvips/libvips/Product
• https://github.com/libvips/libvips/commit/7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91Patch
• https://github.com/libvips/libvips/issues/4881Exploit, Issue Tracking, Vendor Advisory
• https://github.com/libvips/libvips/issues/4881#issue-3944216443Exploit, Issue Tracking, Vendor Advisory
• https://github.com/libvips/libvips/pull/4886Issue Tracking, Patch
• https://vuldb.com/?ctiid.348011Permissions Required, VDB Entry
• https://vuldb.com/?id.348011Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.758862Third Party Advisory, VDB Entry

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32814libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32815SiYuan is a personal knowledge management system. In version…7.5
• CVE-2026-32816Admidio is an open-source user management solution. In versi…5.7
• CVE-2026-32817Admidio is an open-source user management solution. In versi…9.1
• CVE-2026-32818Admidio is an open-source user management solution. In versi…6.5
• CVE-2026-32819dataCycle is a data management system for centrally storing,…4.3
• CVE-2026-32820dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32821dataCycle is a data management system for centrally storing,…8.1
• CVE-2026-32822dataCycle is a data management system for centrally storing,…6.1
• CVE-2026-32823dataCycle is a data management system for centrally storing,…4.3
• CVE-2026-32824dataCycle is a data management system for centrally storing,…7.3
• CVE-2026-32825dataCycle is a data management system for centrally storing,…7.3