CVE-2026-5342: LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds
A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikonloadpaddedpackedraw of the file src/decoders/decoderslibraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument loadflags/rawwidth can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librawto a version that resolves this vulnerability.Fixed in 0.22.1-1 - Upgrade
Upgrade
LibRaw (TIFF/NEF decoder) src/decoders/decoders_libraw.cppto a version that resolves this vulnerability.Fixed in 0.22.1Patch b8397cd45657b84e88bd1202528d1764265f185c
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5342?
CVE-2026-5342 is considered a high-severity vulnerability due to its potential for out-of-bounds access leading to application crashes or arbitrary code execution.
How do I fix CVE-2026-5342?
To fix CVE-2026-5342, update LibRaw to version 0.22.1 or later, where the vulnerability has been addressed.
What component of LibRaw is affected by CVE-2026-5342?
CVE-2026-5342 affects the TIFF/NEF decoders in the LibRaw library.
Can CVE-2026-5342 be exploited remotely?
Yes, CVE-2026-5342 can potentially be exploited remotely if a vulnerable application processes maliciously crafted TIFF or NEF files.
What versions of LibRaw are affected by CVE-2026-5342?
LibRaw versions up to and including 0.22.0 are affected by CVE-2026-5342.