LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/librawcxx.cpp) and fujirotate() function (src/decoders/fuji.cpp).
LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).Security Fix(es): LibRaw: LibRaw: Arbitrary code execution via a specially crafted malicious file (CVE-2026-24450) LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading (CVE-2026-21413) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
https://www.libraw.org/news/libraw-0-22-1-release announces: LibRaw 0.22.1 Release is just published in our Github repository <https://github.com/LibRaw/LibRaw> and this site download section <https://www.libraw.org/download>.
This is bugfix-only release with these commits included:
Limit strcat space in hassy model manipulation Version increment; shlib increment: internal ABI has changed check panasonic enc8 tile width against image width CR3 parser: zero all buffers before fread skip memory allocation checks for OWNALLOC decoders DNG SDK glue: check for memory limits raw2image()/dcrawprocess() - check for int16 source data present Check for correct bayer pattern, pass incorect ones to vnginterpolate parserollei: zero input string before fgets Nikon padded/12bit: no need to calculate padded row size before final rawwidth adjustment TALOS-2026-2364: Fix for data size calculation integer overflow in float/deflated DNG loader; Check for read results Fix for TALOS-2026-2363: avoid integer overflow in allocation size calculation. Also: check for EOF in read loop X3F decoder: implemented hard single allocation limit via LIBRAWX3FALLOCLIMITMB define; allocation size calculation converted to 64 bit arithm; fix for TALOS-2026-2359 Fix for TALOS-2026-2358 Fix for TALOS-2026-2331 Fix for TALOS-2026-2330 Sony YCC decoder: check tile size; add +3 bytes to input buffer to avoid possible overrun in huffman decoder FP DNG data limit: perform calculations in 64 bit Add extra huffcoeff item to handle huffindex==17 with known (zero) value, not externally provided tag value use %lld format for timestamp parse/print where appropriate nikon coolscan loader: check for EOF Initialize olympus lensID bits CR3 parser: all file offsets are unsigned/64bit; check current offset against file size Add Canon EOS Kiss M2 to camera list Check real color count against filters; do not pass really 4-color images to fbdd or advanced demosaic Use LIBRAWEXCEPTION instead of own internal in losslessjpeg.h zero input string to avoid compare random stack garbage with tag names Check for eof in Pentax tag search loop Fuji decoder: initialize allocated buffers Further information about the vulnerabilities reported by Cisco Talos can be found in their reports:
- TALOS-2026-2330 / CVE-2026-20911 LibRaw HuffTable::initval heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2330
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2331 / CVE-2026-21413 LibRaw losslessjpegloadraw heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2331
A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2358 / CVE-2026-20889 LibRaw x3fthumbloader heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2358
A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2359 / CVE-2026-24660 LibRaw x3floadhuffman heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2359
A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2363 / CVE-2026-24450 LibRaw uncompressedfpdngloadraw integer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2363
An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2364 / CVE-2026-20884 LibRaw deflatedngloadraw integer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2364
An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Additional CVEs also appear to have been issued for some of the fixes:
- CVE-2026-5318 appears to be a duplicate for independent reporting of the TALOS-2026-2330 / CVE-2026-20911 issue in https://github.com/LibRaw/LibRaw/issues/794
- CVE-2026-5342 for the fix listed above as "Nikon padded/12bit: no need to calculate padded row size before final rawwidth adjustment" and originally reported in https://github.com/LibRaw/LibRaw/issues/795
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikonloadpaddedpackedraw of the file src/decoders/decoderslibraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument loadflags/rawwidth can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
A type confusion error within the "unpackedloadraw()" function within LibRaw versions prior to 0.19.1 (internal/dcrawcommon.cpp) can be exploited to trigger an infinite loop.
An error within the "parsesinaria()" function (internal/dcrawcommon.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.
An error within the "parserollei()" function (internal/dcrawcommon.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.
Last updated 11 July 2025
Last updated 11 July 2025
Last updated 11 July 2025
Last updated 11 July 2025
An error within the "rolleiloadraw()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
An error within the "nikoncoolscanloadraw()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to trigger a NULL pointer dereference.
An error within the "parseminolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file.
An integer overflow error within the "identify()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger a division by zero via specially crafted NOKIARAW file (Note: This vulnerability is caused due to an incomplete fix of CVE-2018-5804).
An error related to the "LibRaw::panasonicloadraw()" function (dcrawcommon.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.
An error within the "LibRaw::xtransinterpolate()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of Service condition.
An error within the "nikoncoolscanloadraw()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.