CVE-2026-3147
📋 TL;DR
A heap-based buffer overflow vulnerability in libvips' CSV loading function allows local attackers to potentially execute arbitrary code or crash applications. This affects systems using libvips up to version 8.18.0 for processing CSV files. The vulnerability requires local access to exploit.
💻 Affected Systems
- libvips
📦 What is this software?
Libvips by Libvips
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to complete system compromise via arbitrary code execution.
Likely Case
Application crash (denial of service) or limited information disclosure from heap memory.
If Mitigated
No impact if proper access controls prevent local attackers from supplying malicious CSV files.
🎯 Exploit Status
Exploit requires local access and ability to supply malicious CSV file. Public exploit details exist in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.18.1 or later, or commit b3ab458a25e0e261cbd1788474bbc763f7435780
Vendor Advisory: https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435780
Restart Required: Yes
Instructions:
1. Update libvips to version 8.18.1 or later
2. For source installations: apply commit b3ab458a25e0e261cbd1788474bbc763f7435780
3. Restart any services using libvips
🔧 Temporary Workarounds
Disable CSV processing
allRemove or disable CSV file processing capabilities in applications using libvips
Restrict file uploads
allImplement strict validation and sanitization of CSV files before processing
🧯 If You Can't Patch
- Implement strict access controls to prevent local users from supplying CSV files
- Use application sandboxing or containerization to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check libvips version: vips --version | grep -E '8\.(1[0-7]|18\.0)'Check Version:
vips --versionVerify Fix Applied:
Verify version is 8.18.1 or later: vips --version | grep -E '8\.(1[8-9]|2[0-9])'📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unusual memory access patterns in system logs
- Failed CSV file processing attempts
Network Indicators:
- None - local exploitation only
SIEM Query:
process.name:"vips" AND (event.action:"segmentation_fault" OR event.action:"memory_access_violation")🔗 References
- https://github.com/libvips/libvips/
- https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435780
- https://github.com/libvips/libvips/issues/4874
- https://github.com/libvips/libvips/issues/4874#issue-3943617697
- https://github.com/libvips/libvips/pull/4894
- https://vuldb.com/?ctiid.347653
- https://vuldb.com/?id.347653
- https://vuldb.com/?submit.758692
