See how libraw compares to other vendors in security performance
LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/librawcxx.cpp) and fujirotate() function (src/decoders/fuji.cpp).
LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).Security Fix(es): LibRaw: LibRaw: Arbitrary code execution via a specially crafted malicious file (CVE-2026-24450) LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading (CVE-2026-21413) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
https://www.libraw.org/news/libraw-0-22-1-release announces: LibRaw 0.22.1 Release is just published in our Github repository <https://github.com/LibRaw/LibRaw> and this site download section <https://www.libraw.org/download>.
This is bugfix-only release with these commits included:
Limit strcat space in hassy model manipulation Version increment; shlib increment: internal ABI has changed check panasonic enc8 tile width against image width CR3 parser: zero all buffers before fread skip memory allocation checks for OWNALLOC decoders DNG SDK glue: check for memory limits raw2image()/dcrawprocess() - check for int16 source data present Check for correct bayer pattern, pass incorect ones to vnginterpolate parserollei: zero input string before fgets Nikon padded/12bit: no need to calculate padded row size before final rawwidth adjustment TALOS-2026-2364: Fix for data size calculation integer overflow in float/deflated DNG loader; Check for read results Fix for TALOS-2026-2363: avoid integer overflow in allocation size calculation. Also: check for EOF in read loop X3F decoder: implemented hard single allocation limit via LIBRAWX3FALLOCLIMITMB define; allocation size calculation converted to 64 bit arithm; fix for TALOS-2026-2359 Fix for TALOS-2026-2358 Fix for TALOS-2026-2331 Fix for TALOS-2026-2330 Sony YCC decoder: check tile size; add +3 bytes to input buffer to avoid possible overrun in huffman decoder FP DNG data limit: perform calculations in 64 bit Add extra huffcoeff item to handle huffindex==17 with known (zero) value, not externally provided tag value use %lld format for timestamp parse/print where appropriate nikon coolscan loader: check for EOF Initialize olympus lensID bits CR3 parser: all file offsets are unsigned/64bit; check current offset against file size Add Canon EOS Kiss M2 to camera list Check real color count against filters; do not pass really 4-color images to fbdd or advanced demosaic Use LIBRAWEXCEPTION instead of own internal in losslessjpeg.h zero input string to avoid compare random stack garbage with tag names Check for eof in Pentax tag search loop Fuji decoder: initialize allocated buffers Further information about the vulnerabilities reported by Cisco Talos can be found in their reports:
- TALOS-2026-2330 / CVE-2026-20911 LibRaw HuffTable::initval heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2330
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2331 / CVE-2026-21413 LibRaw losslessjpegloadraw heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2331
A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2358 / CVE-2026-20889 LibRaw x3fthumbloader heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2358
A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2359 / CVE-2026-24660 LibRaw x3floadhuffman heap-based buffer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2359
A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2363 / CVE-2026-24450 LibRaw uncompressedfpdngloadraw integer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2363
An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- TALOS-2026-2364 / CVE-2026-20884 LibRaw deflatedngloadraw integer overflow vulnerability https://talosintelligence.com/vulnerabilityreports/TALOS-2026-2364
An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Additional CVEs also appear to have been issued for some of the fixes:
- CVE-2026-5318 appears to be a duplicate for independent reporting of the TALOS-2026-2330 / CVE-2026-20911 issue in https://github.com/LibRaw/LibRaw/issues/794
- CVE-2026-5342 for the fix listed above as "Nikon padded/12bit: no need to calculate padded row size before final rawwidth adjustment" and originally reported in https://github.com/LibRaw/LibRaw/issues/795
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikonloadpaddedpackedraw of the file src/decoders/decoderslibraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument loadflags/rawwidth can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
It was discovered that LibRaw could be made to read out of bounds. An attacker could possibly use this issue to cause applications using LibRaw to crash, resulting in a denial of service. (CVE-2025-43961, CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)
In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values.
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp allows out-of-buffer access because splitcol and splitrow values are not checked in 0x041f tag processing.
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspectratio.cpp.
A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex() caused by a maliciously crafted file may lead to an application crash.
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::gets(char, int) in /src/libraw/src/librawdatastream.cpp.
https://github.com/LibRaw/LibRaw/commit/bc3aaf4223fdb70d52d470dae65c5a7923ea2a49 https://github.com/LibRaw/LibRaw/issues/400
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::gets(char, int) in /src/libraw/src/librawdatastream.cpp.
In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobecopypixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
In LibRaw, there is an out-of-bounds write vulnerability within the "newnode()" function (libraw\src\x3f\x3futilspatched.cpp) that can be triggered via a crafted X3F file.
In LibRaw, an out-of-bounds read vulnerability exists within the gethuffmandiff() function (libraw\src\x3f\x3futilspatched.cpp) when reading data from an image file.