CVE-2026-3146: Libvips Use-After-Free Vulnerability

CVE-2026-3146 Overview

A null pointer dereference vulnerability has been discovered in libvips, a widely-used image processing library. The vulnerability exists in the vips_foreign_load_matrix_header function within the file libvips/foreign/matrixload.c. When processing specially crafted matrix input files, the function fails to properly validate input data, leading to a null pointer dereference condition that can cause application crashes.

Critical Impact

Local attackers can exploit this vulnerability to cause denial of service conditions in applications that utilize libvips for image processing operations, particularly when loading matrix format files.

Affected Products

• libvips versions up to and including 8.18.0

Discovery Timeline

• 2026-02-25 - CVE-2026-3146 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-3146

Vulnerability Analysis

This vulnerability is classified as a null pointer dereference (CWE-404) that occurs during the matrix file loading process in libvips. The vips_foreign_load_matrix_header function processes matrix file headers without adequately validating input boundaries. When the function encounters empty or malformed input data, it fails to handle the null condition gracefully, resulting in an attempt to dereference a null pointer.

The attack requires local access to the system where libvips is installed. An attacker would need to provide a malicious matrix file to an application that uses libvips for processing. Upon attempting to load the crafted file, the application would crash due to the null pointer dereference, resulting in a denial of service condition.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the matrix loading functionality. The vips_foreign_load_matrix_header function does not properly guard against empty and very large inputs when parsing matrix file headers. When the token parsing routine encounters unexpected input formats, it can return null values that are subsequently dereferenced without proper null checks.

Attack Vector

This is a local attack vector vulnerability. An attacker must have the ability to provide a specially crafted matrix file to an application that processes images using libvips. The attack scenario typically involves:

1. Creating a malicious matrix file with empty or oversized header values
2. Providing this file to a target application that uses libvips
3. The application attempts to load the matrix file using vips_foreign_load_matrix_header
4. The function encounters the malformed data and dereferences a null pointer
5. The application crashes, resulting in denial of service

The following patch was applied to address the vulnerability:

 - fix loading/saving of non-8-bit JXL images [DarthSim]
 - invertlut: check height before interpolating values [dloebl] [lovell]
 - extract: check bounds using unsigned arithmetic [Niebelungen-D] [lovell]
+- matrixload: guard against empty and very large inputs [Niebelungen-D] [lovell]

 17/12/25 8.18.0

Source: GitHub Commit Details

The fix also includes an error message correction in the matrix loading code:

	for (i = 0, p = line; (q = vips_break_token(p, " \t")) && i < 4; i++, p = q)
		if (vips_strtod(p, &header[i])) {
-			vips_error("matload", _("bad number \"%s\""), p);
+			vips_error("matrixload", _("bad number \"%s\""), p);
			return -1;
		}

Source: GitHub Commit Details

Detection Methods for CVE-2026-3146

Indicators of Compromise

• Application crashes when processing matrix format files with segmentation fault signals
• Core dumps from applications using libvips with stack traces pointing to vips_foreign_load_matrix_header
• Unusual or repeated crashes in image processing workflows that handle matrix files
• Error logs showing null pointer dereference exceptions in libvips library calls

Detection Strategies

• Monitor application crash logs for segmentation faults originating from libvips library functions
• Implement file validation to detect malformed or suspicious matrix files before processing
• Use static analysis tools to identify applications using vulnerable versions of libvips
• Deploy software composition analysis to inventory libvips versions across your environment

Monitoring Recommendations

• Enable core dump collection for applications that utilize libvips for forensic analysis
• Configure application health monitoring to alert on unexpected process terminations
• Implement input file logging to track matrix files processed by vulnerable applications
• Set up version monitoring for libvips installations to ensure timely patching

How to Mitigate CVE-2026-3146

Immediate Actions Required

• Inventory all applications and systems using libvips and identify versions prior to the patch
• Apply the security patch identified by commit hash d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
• Restrict access to matrix file upload functionality until patching is complete
• Review application logs for evidence of exploitation attempts or crashes

Patch Information

The vulnerability has been addressed by the libvips development team. The fix adds proper guards against empty and very large inputs in the matrix loading functionality. The patch is available at GitHub Commit Details. Additional details about the vulnerability discovery can be found in GitHub Issue #4875, and the fix implementation is tracked in GitHub Pull Request #4888.

Workarounds

• Disable matrix file loading functionality in applications where it is not required
• Implement input validation to reject matrix files before they reach libvips processing
• Use application sandboxing to contain potential crashes and limit impact
• Deploy file type restrictions to prevent untrusted matrix files from being processed

# Check installed libvips version
vips --version

# If using package managers, update to latest patched version
# Debian/Ubuntu
apt-get update && apt-get upgrade libvips

# Fedora/RHEL
dnf update vips

# From source with patch applied
git clone https://github.com/libvips/libvips.git
cd libvips
git checkout d4ce337c76bff1b278d7085c3c4f4725e3aa6ece
./autogen.sh && make && sudo make install