Skip to main content

Libraw CVE-2026-20889

| EUVDEUVD-2026-19620 CRITICAL
Integer Overflow or Wraparound (CWE-190)
2026-04-07 talos GHSA-9m8r-gj3p-r7rw
Buffer Overflow Integer Overflow Libraw
9.8
CVSS 3.1 · Vendor: talos
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts malicious X3F image file
  2. Delivery
    Victim processes file with LibRaw
  3. Exploit
    x3f_thumb_loader parses thumbnail data
  4. Execution
    Heap buffer overflow triggered
  5. Impact
    Arbitrary code execution with full privileges

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote attacker sends a malicious x3f (Sigma RAW) image file to victim. Exploitation occurs when LibRaw processes the file via x3f_thumb_loader functionality. No authentication or user interaction required beyond file processing by vulnerable LibRaw commit d20315b or affected versions.
Impact

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates maximum exploitability with network-based delivery, low attack complexity, no authentication requirements, and no user interaction needed. This represents a critical pre-authentication remote code execution risk in any service that automatically processes uploaded images or generates thumbnails. The technical impact spans complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H). However, real-world risk assessment requires context: many LibRaw deployments process images in sandboxed environments or containerized workflows that would limit post-exploitation impact. The vulnerability requires the attacker to deliver a malicious X3F file to a processing endpoint, making it most dangerous in automated image handling systems like photo sharing platforms, email attachment scanners with preview generation, or content management systems with thumbnail creation. No public exploit code is identified at time of analysis, and no CISA KEV listing exists to confirm active exploitation campaigns. The SSVC framework would classify this as having high technical impact with automatable exploitation potential once weaponized, but current exploitation status remains unconfirmed, suggesting monitoring and scheduled patching rather than emergency response for most environments.
Exploit ScenarioDerived

An attacker crafts a malicious Sigma X3F camera raw file with manipulated thumbnail metadata that triggers integer overflow during size calculations in x3f_thumb_loader. The attacker uploads this file to a photo sharing website or sends it as an email attachment to an organization using automated thumbnail generation. When the server-side image processing pipeline invokes LibRaw to create preview thumbnails, the undersized heap buffer is allocated and subsequently overflowed with attacker-controlled data. The overflow overwrites adjacent heap metadata or function pointers, allowing the attacker to redirect execution flow and achieve remote code execution within the image processing service context, potentially escaping sandbox restrictions through secondary vulnerabilities or gaining access to stored images and user data.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Heap-based buffer overflow in LibRaw's x3f_thumb_loader function allows remote code execution via malformed image files. The vulnerability affects LibRaw commit d20315b, a widely-used raw image processing library integrated into applications like ImageMagick, GIMP, and numerous photo management tools. The CVSS 9.8 critical rating reflects network-exploitable conditions requiring no authentication or user interaction. With an EPSS score not yet available and no CISA KEV listing, active exploitation is not confirmed at time of analysis, though the attack complexity is low and requires only delivering a specially crafted file to vulnerable processing workflows.

RemediationAI

Organizations should immediately audit their application stack for LibRaw dependencies and prioritize patching systems that process untrusted image files. Upstream fix availability not independently confirmed from available data at time of analysis; monitor the LibRaw GitHub repository and the Cisco Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358 for release announcements. As interim mitigation, implement strict input validation to reject malformed X3F files before LibRaw processing, deploy image processing in sandboxed or containerized environments with minimal privileges, and disable automatic thumbnail generation for X3F format if business requirements permit. For high-risk environments like public-facing image upload services, consider temporarily disabling X3F format support until patches are deployed. Ensure LibRaw-dependent applications like ImageMagick and GIMP are updated once their respective vendors release patched versions incorporating the LibRaw fix.

Affected VersionsENISA

LibRaw Commit d20315b

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

LibRaw is an open-source library for reading and processing raw digital camera image formats. The vulnerability resides in the x3f_thumb_loader function, which handles thumbnail extraction from Sigma X3F camera files. The root cause is an integer overflow (CWE-190) during buffer size calculations that leads to undersized heap allocation. When processing thumbnail data, the overflow causes the library to allocate insufficient memory, followed by out-of-bounds writes during data copying operations. The affected CPE cpe:2.3:a:libraw:libraw indicates the core library itself is vulnerable, meaning any application statically or dynamically linking LibRaw for raw image processing inherits this exposure. The x3f_thumb_loader typically executes during early file parsing stages, before user-visible rendering, making the vulnerability triggerable through automated image processing pipelines, thumbnail generators, or preview functions.

Know when Libraw gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (talos) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 7.5 HIGH

Primary rating from Vendor (talos).

CVSS VectorVendor: talos

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Apr 07, 2026 - 13:49 nvd
CRITICAL 9.8

DescriptionCVE.org

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Executive ViewAI

Why It Matters

LibRaw's image processing library contains a critical heap-based buffer overflow (CVE-2026-20889, CVSS 9.8) affecting downstream applications including ImageMagick and GIMP, enabling remote code execution through malformed image files without authentication. Organizations using these tools face immediate risk of system compromise if untrusted images are processed, with no vendor patch currently available. Remediation requires urgent identification of affected systems and implementation of interim controls to restrict image processing workflows.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable processing of untrusted raw image formats (.x3f, .arw, .cr2, .nef) at application or gateway level; (2) Isolate image processing servers on restricted network segments with no direct internet access; (3) Implement file type validation and rejection of malformed image headers before processing; (4) Run image processing services under least-privilege accounts with no shell access; (5) Enable application whitelisting to restrict LibRaw library execution; (6) Monitor LibRaw GitHub and vendor security advisories for patch availability.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Related Vulnerabilities in LibRaw Buffer Overflow Vulnerabilities

View all 6
CVE-2026-24660 HIGH
8.1
CVE-2026-21413 CRITICAL
9.8
CVE-2026-20884 HIGH
8.1
CVE-2026-24450 HIGH
8.1
CVE-2026-20911 CRITICAL
9.8

More in Libraw

View all
CVE-2018-20337 HIGH POC
8.8 Dec 21

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Rated high

CVE-2013-2126 HIGH POC
7.5 Aug 14

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow cont
CVE-2020-24889 HIGH POC
7.8 Sep 16

A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp

CVE-2013-2127 HIGH POC
7.5 Aug 14

Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a de
CVE-2023-1729 MEDIUM POC
6.5 May 15

A flaw was found in LibRaw. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenticat
CVE-2020-15365 MEDIUM POC
6.5 Jun 28

LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomNam
CVE-2018-20365 MEDIUM POC
6.5 Dec 22

LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerabi
CVE-2018-20364 MEDIUM POC
6.5 Dec 22

LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Rated medium severity (CVSS 6.5),

CVE-2018-20363 MEDIUM POC
6.5 Dec 22

LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Rated medium severity (CVSS 6.5), t
CVE-2017-14265 CRITICAL
9.8 Sep 11

A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3.
CVE-2017-6886 CRITICAL
9.8 May 16

An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be expl

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-20889 ADVISORY https://ubuntu.com/security/notices/USN-8522-1 ADVISORY https://vuldb.com/vuln/355752 REF https://access.redhat.com/errata/RHSA-2026:13284 REF https://access.redhat.com/errata/RHSA-2026:14224 REF https://access.redhat.com/errata/RHSA-2026:14655 REF https://access.redhat.com/errata/RHSA-2026:14673 REF https://access.redhat.com/security/cve/CVE-2026-20889 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455942 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20889.json REF https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358 REF https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2358

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy