A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha_band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be applied to remediate this issue.
CVE-2026-3282 is a low-severity out-of-bounds read vulnerability in libvips 8.19.0's unpremultiply function that can be exploited locally through manipulation of the alpha_band argument. The vulnerability requires local access and has a published exploit, necessitating prompt patching.
ثغرة في مكتبة معالجة الصور libvips الإصدار 8.19.0 تسمح بقراءة البيانات خارج حدود الذاكرة المخصصة عند التلاعب بمعامل alpha_band في دالة vips_unpremultiply_build. الهجوم يتطلب وصول محلي والاستغلال متاح بالفعل.
This vulnerability in libvips 8.19.0 allows local attackers to trigger out-of-bounds memory reads by manipulating the alpha_band parameter in the unpremultiply function. Although low severity, the published exploit and local attack vector warrant timely remediation for affected systems.
Update libvips to a patched version beyond 8.19.0 or apply patch 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. Restrict local access to systems running vulnerable versions and monitor for exploitation attempts.
قم بتحديث libvips إلى إصدار مصحح أحدث من 8.19.0 أو طبق التصحيح 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. قيد الوصول المحلي للأنظمة التي تعمل بالإصدارات الضعيفة ومراقبة محاولات الاستغلال.