Is CVE-2026-3145 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-3145, but active exploitation has not been confirmed.

Can CVE-2026-3145 be exploited remotely?

No. CVE-2026-3145 requires local access to exploit.

What is the CVSS score of CVE-2026-3145?

CVE-2026-3145 has a CVSS score of 7.8 (HIGH) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2026-3145

HIGHPOC

CVE-2026-3145

CWE-119Published: February 25, 2026· Updated: Feb 25, 2026

7.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.0th

Official Description

A flaw has been found in libvips up to 8.18.0. The affected element is the function vips_foreign_load_matrix_file_is_a/vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. This patch is called d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. A patch should be applied to remediate this issue.

NVD Source

Technical Analysis

CVE-2026-3145 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

A proof-of-concept (PoC) exploit exists for CVE-2026-3145. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.