Summary
LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).
Security Fix(es):
* LibRaw: LibRaw: Memory Corruption via Malicious File Processing (CVE-2026-24660)
* LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading (CVE-2026-21413)
* LibRaw: LibRaw: Arbitrary code execution via specially crafted image file (CVE-2026-20889)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | LibRaw | 0.19.5-6.el8_10 |
| AlmaLinux · 8 | LibRaw-devel | 0.19.5-6.el8_10 |
Vulnerabilities 3
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A spe…
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 …
-
High 8.1
A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A spe…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-20889
-
report
https://access.redhat.com/security/cve/CVE-2026-21413
-
report
https://access.redhat.com/security/cve/CVE-2026-24660
-
report
https://bugzilla.redhat.com/2455926
-
report
https://bugzilla.redhat.com/2455929
-
report
https://bugzilla.redhat.com/2455942
-
advisory
https://errata.almalinux.org/8/ALSA-2026-13284.html