CVE-2026-3146
📋 TL;DR
This CVE describes a null pointer dereference vulnerability in libvips image processing library. Attackers with local access can cause denial of service by triggering a crash in the vips_foreign_load_matrix_header function. Users of applications that incorporate libvips up to version 8.18.0 are affected.
💻 Affected Systems
- libvips
📦 What is this software?
Libvips by Libvips
⚠️ Risk & Real-World Impact
Worst Case
Local denial of service causing application crash and potential data loss if unsaved work exists
Likely Case
Application crash when processing malicious matrix files, requiring restart
If Mitigated
Minimal impact with proper access controls limiting local user privileges
🎯 Exploit Status
Exploitation requires local access and ability to trigger the vulnerable function with crafted input
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
Vendor Advisory: https://github.com/libvips/libvips/issues/4875
Restart Required: Yes
Instructions:
1. Update libvips to version 8.18.1 or later
2. Rebuild applications using libvips if statically linked
3. Restart affected services
🔧 Temporary Workarounds
Restrict local user access
allLimit local user privileges to reduce attack surface
Disable matrix file processing
allConfigure applications to avoid using vips_foreign_load_matrix_header function
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for application crashes and investigate any suspicious local user activity
🔍 How to Verify
Check if Vulnerable:
Check libvips version with 'vips --version' or 'ldconfig -p | grep libvips'Check Version:
vips --version 2>/dev/null || pkg-config --modversion vips-api 2>/dev/null || echo "libvips not found"Verify Fix Applied:
Verify version is 8.18.1 or later, or check if commit d4ce337c76bff1b278d7085c3c4f4725e3aa6ece is present in source📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults in libvips
- Error logs mentioning vips_foreign_load_matrix_header
Network Indicators:
- None - local exploitation only
SIEM Query:
process.name:"vips" AND event.action:"segmentation fault" OR process.name:"vips" AND exit_code:"139"🔗 References
- https://github.com/libvips/libvips/
- https://github.com/libvips/libvips/commit/d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
- https://github.com/libvips/libvips/issues/4875
- https://github.com/libvips/libvips/pull/4888
- https://vuldb.com/?ctiid.347652
- https://vuldb.com/?id.347652
- https://vuldb.com/?submit.758691
- https://github.com/libvips/libvips/issues/4875
