High ELSA-2026-13284 3 CVEs

Important: LibRaw security update (Oracle Linux 8)

Published May 5, 2026 · Updated May 5, 2026

Ecosystem: Oracle Linux

Summary

[0.19.5-6]
- Backport fix for CVE-2026-24660 from upstream
Resolves: RHEL-165412

[0.19.5-5]
- Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream
- Migrate to SPDX license
Resolves: RHEL-165404, RHEL-165408

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	LibRaw	0:0.19.5-6.el8_10
Oracle Linux · 8	LibRaw-devel	0:0.19.5-6.el8_10

Vulnerabilities 3

Critical 9.8

CVE-2026-20889

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A spe…

LibRaw LibRaw kodi dcraw Debian Ubuntu Azure Linux Alpine

Apr 7, 2026
Critical 9.8

CVE-2026-21413

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 …

LibRaw LibRaw kodi dcraw Debian Ubuntu Azure Linux Alpine

Apr 7, 2026
High 8.1

CVE-2026-24660

A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A spe…

LibRaw LibRaw kodi dcraw Debian Ubuntu Alpine

Apr 7, 2026