Executive Summary

CVE-2026-3147 is a heap-based buffer overflow vulnerability in the libvips image processing library, specifically in the function vips_foreign_load_csv_build within the csvload.c file.

The issue arises because the function improperly handles the --whitespace and --separator command-line options, which accept byte values used as indexes into fixed-size 256-byte arrays. On platforms where the char data type is signed, non-ASCII UTF-8 bytes can be interpreted as negative integers. These negative values are then used as array indexes, causing out-of-bounds writes before the start of the arrays, leading to memory corruption.

This vulnerability can be triggered locally by providing non-ASCII characters (such as emojis) to the whitespace or separator options during CSV file processing, resulting in heap-buffer-overflow errors detected by tools like AddressSanitizer.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption due to heap-based buffer overflow, which may cause application crashes or unpredictable behavior in the libvips library when processing CSV files with specially crafted inputs.

Since the exploit requires local access, an attacker with local privileges could exploit this flaw to compromise the stability or integrity of the system running libvips.

The vulnerability could potentially be used to execute arbitrary code or escalate privileges, depending on the context and environment, although the CVSS scores indicate a moderate severity level.

Applying the patch that validates the whitespace and separator characters as strictly ASCII prevents this issue and mitigates the risk.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to reproduce the heap-based buffer overflow using the vulnerable libvips csvload functionality with non-ASCII whitespace or separator characters.'}, {'type': 'paragraph', 'content': 'A practical detection method is to run the `vips csvload` command with the `--whitespace` option set to a non-ASCII UTF-8 character such as an emoji (e.g., 😀). This triggers the out-of-bounds access and can be detected by tools like AddressSanitizer (ASAN), which reports a heap-buffer-overflow error.'}, {'type': 'list_item', 'content': 'Build libvips with AddressSanitizer enabled for debugging.'}, {'type': 'list_item', 'content': "Run a command similar to: `vips csvload --whitespace='😀' <csv-file>` to trigger the vulnerability."}, {'type': 'paragraph', 'content': 'If ASAN is enabled, it will detect and report the heap-buffer-overflow caused by negative indexing in the CSV loader.'}] [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to apply the official patch that fixes the vulnerability by validating that the whitespace and separator characters used in CSV parsing are strictly ASCII.

This patch prevents non-ASCII characters from being used, which stops the negative indexing and heap overflow.

• Update libvips to a version that includes the patch identified by commit b3ab458a25e0e261cbd1788474bbc763f7435780.
• If updating immediately is not possible, avoid using non-ASCII characters in the `--whitespace` and `--separator` options when running `vips csvload`.

Applying the patch or upgrading to a fixed version is the most effective way to mitigate the risk of exploitation.

Useful 0 Not Useful 0