CVE-2026-3283

CVE-2026-3283 is an out-of-bounds read vulnerability in libvips version 8.19.0, specifically within the vips_extract_band_build function of the extract.c file. This flaw allows a local attacker to cause a denial of service or potentially disclose sensitive information by manipulating the extract_band argument. Rated with a CVSS score of 7.1 (HIGH), the vulnerability requires local access and low privileges, but has a high impact on confidentiality and availability. The exploit has been publicly disclosed, indicating a heightened risk. While there is no evidence of active exploitation (KEV: No) and no Metasploit or Nuclei modules, the public disclosure of exploit details and a single community mention suggest awareness among threat actors. A patch is available and recommended for immediate deployment.