redhat/LibRaw vulnerabilities

Latest redhat/LibRaw CVEs

Newest publication first

1. CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

   Published 2026-10-15

   Medium·CVSS 6.8 EPSS 0.13%

   LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decodin...

2. CVE-2026-88387 LibRaw: LibRaw: Denial of Service via improper numeric conversion

   Published 2026-09-24

   Medium·CVSS 5.5 EPSS 0.18%

   LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int....

3. CVE-2026-20911 LibRaw: LibRaw: Arbitrary Code Execution via specially crafted file

   Published 2026-04-07

   Critical·CVSS 9.8 EPSS 0.64%

   A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

4. CVE-2026-21413 Raw Image Extension Remote Code Execution Vulnerability

   Published 2026-04-07

   Critical·CVSS 9.8 EPSS 1.4%

   A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

5. CVE-2026-20889 LibRaw: LibRaw: Arbitrary code execution via specially crafted image file

   Published 2026-04-07

   Critical·CVSS 9.8 EPSS 0.84%

   A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

6. CVE-2026-24660 LibRaw: LibRaw: Memory Corruption via Malicious File Processing

   Published 2026-04-07

   Critical·CVSS 9.8 EPSS 0.72%

   A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

7. CVE-2026-24450 LibRaw: LibRaw: Arbitrary code execution via a specially crafted malicious file

   Published 2026-04-07

   Critical·CVSS 9.8 EPSS 0.59%

   An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

8. CVE-2026-20884 LibRaw: LibRaw: Arbitrary code execution via integer overflow in deflate_dng_load_raw

   Published 2026-04-07

   Critical·CVSS 9.8 EPSS 0.59%

   An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

9. CVE-2026-5342 LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds

   Published 2026-04-02

   Medium·CVSS 6.9 EPSS 0.76%

   A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It is...

10. CVE-2026-5318 LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write

    Published 2026-04-02

    Medium·CVSS 5.3 EPSS 0.64%

    A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.