CVE-2026-3146 is a null pointer dereference vulnerability in libvips versions up to 8.18.0, specifically within the vips_foreign_load_matrix_header function. This vulnerability has a CVSS score of 5.5 (Medium), indicating that a local attacker with low privileges can cause a denial of service. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion. The EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.18.0CPE matchmatch criteria | cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.