The vulnerability resides in libvips 8.19.0 within the function vips_extract_band_build, where manipulation of the extract_band argument results in an out-of-bounds read. This flaw corresponds to the weaknesses CWE-119 and CWE-125. An attacker can read memory beyond the intended bounds, potentially exposing sensitive data or causing a crash. The impact is limited to a local context, as the exploit requires local code execution to manipulate the argument.

The only affected version explicitly identified is libvips 8.19.0. The library is distributed as libvips 8.19.0, and earlier or later releases are not listed as impacted in the provided data.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1 % implies a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local and requires manipulation of the extract_band argument, the risk to systems that do not provide local privilege to attackers is limited, but systems that allow local code execution may be able to exploit this defect to read sensitive memory.