CVE-2026-3146 — Improper Resource Shutdown or Release in Vips

CWE-404 — Improper Resource Shutdown or ReleaseCWE-476 — NULL Pointer Dereference5 documents5 sources
Severity
4.8MEDIUMNVD
EPSS
0.0%
top 97.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian VipsLibvips
Timeline
PublishedFeb 25

Description

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDlibvips/libvips8.18.0
▶CVEListV5libvips/libvips19 versions+18
▶debiandebian/vips< vips 8.18.0-3 (forky)

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v5rp-3mcx-fr73: A vulnerability has been found in libvips up to 8↗2026-02-25
▶
OSV
CVE-2026-3146: A vulnerability has been found in libvips up to 8↗2026-02-25
▶

📋Vendor Advisories

1
Debian
CVE-2026-3146: vips - A vulnerability has been found in libvips up to 8.18.0. The impacted element is ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-3146 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-3146 — Improper Resource Shutdown or Release | cvebase