Skip to main content

Libraw CVE-2026-21413

| EUVDEUVD-2026-19624 CRITICAL
Improper Validation of Array Index (CWE-129)
2026-04-07 talos GHSA-g53g-r75r-95g5
Buffer Overflow Libraw
9.8
CVSS 3.1 · Vendor: talos
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious JPEG file with oversized data
  2. Delivery
    Send file to LibRaw application
  3. Exploit
    Trigger lossless_jpeg_load_raw parser
  4. Execution
    Overflow heap buffer
  5. Impact
    Execute arbitrary code with application privileges

Vulnerability Assessment

Weakness
CWE
CWE-129
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
Exploitation Conditions

Remote unauthenticated attacker can exploit this by providing a specially crafted malicious JPEG file to any application using LibRaw Commit 0b56545 or Commit d20315b. No victim interaction or special configuration required — vulnerability exists in default lossless_jpeg_load_raw functionality.
Impact

The CVSS 9.8 score reflects maximum severity across confidentiality, integrity, and availability impacts with an easily exploitable network attack vector (AV:N, AC:L, PR:N, UI:N). However, real-world risk requires contextual analysis. The vulnerability affects specific development commits rather than tagged releases, suggesting it may exist in bleeding-edge or custom builds rather than widely deployed stable versions. No EPSS data is provided, but Talos Intelligence disclosure indicates professional security research has characterized the flaw. Absence from CISA KEV catalog and no identified public proof-of-concept code suggests exploitation is not yet widespread. The critical CVSS score is justified by the technical severity-network-exploitable memory corruption leading to code execution-but actual organizational risk depends heavily on whether affected commits are present in deployed software. Applications that automatically process user-uploaded images (web galleries, cloud storage, content management systems) face highest risk. The SSVC framework would likely classify this as requiring expedited remediation due to automatable exploitation potential and high technical impact, though current exploitation status is not confirmed.
Exploit ScenarioDerived

An attacker crafts a malicious RAW image file containing specially formatted JPEG lossless compression data with out-of-bounds array indices in the decompression parameters. The attacker uploads this file to a web application using LibRaw for thumbnail generation or image processing, or sends it via email to a user whose photo management software employs the vulnerable library. When LibRaw's lossless_jpeg_load_raw function parses the malicious file, the unchecked array index triggers a heap buffer overflow, corrupting adjacent memory structures. The attacker leverages this memory corruption to overwrite function pointers or heap metadata, achieving arbitrary code execution in the context of the processing application, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Heap-based buffer overflow in LibRaw's lossless JPEG processing (commits 0b56545 and d20315b) allows unauthenticated remote attackers to achieve arbitrary code execution by providing a malicious image file. The vulnerability scores CVSS 9.8 (Critical) with network attack vector, low complexity, and no authentication required. No CISA KEV listing or public exploit identified at time of analysis, though Talos Intelligence has published detailed vulnerability research (TALOS-2026-2331).

RemediationAI

Organizations should immediately audit LibRaw deployments to determine if vulnerable commits 0b56545 or d20315b are present in production systems. Upstream fix availability not independently confirmed from available data; consult the official LibRaw GitHub repository and Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331 for current patch status and recommended mitigation steps. If patches are unavailable, implement defense-in-depth controls including strict input validation on image file uploads, sandboxing image processing operations in isolated environments with limited privileges, and deploying intrusion detection signatures for malformed JPEG lossless compressed images. For applications accepting user-uploaded images, consider implementing file format restrictions to reject RAW image formats entirely if not business-critical, or pre-process uploads through a hardened conversion service. Monitor LibRaw project announcements for stable release incorporating the fix and prioritize upgrade testing once available.

Affected VersionsENISA

LibRaw Commit d20315b
LibRaw Commit 0b56545

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

LibRaw is an open-source library for reading and processing RAW image files from digital cameras, widely integrated into image processing applications and photography workflows. This vulnerability resides in the lossless_jpeg_load_raw function, which handles JPEG lossless compression parsing within RAW image formats. The root cause is CWE-129 (Improper Validation of Array Index), where insufficient bounds checking on array indices during JPEG decompression allows an attacker-controlled index to write beyond allocated heap memory. The CPE identifier cpe:2.3:a:libraw:libraw identifies the affected library, with specific vulnerable commits 0b56545 and d20315b cited. Heap-based buffer overflows in image parsers are particularly dangerous because they process untrusted external data and can corrupt memory management structures, leading to control flow hijacking.

Know when Libraw gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (talos) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ENISA EUVD HIGH
SUSE CRITICAL
Red Hat 7.5 HIGH

Primary rating from Vendor (talos).

CVSS VectorVendor: talos

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Apr 07, 2026 - 13:49 nvd
CRITICAL 9.8

DescriptionCVE.org

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Executive ViewAI

Why It Matters

LibRaw, a widely-used image processing library, contains a critical heap-based buffer overflow (CVSS 9.8) in JPEG handling that allows unauthenticated remote code execution when processing malicious image files. Any organization using LibRaw in production-including web applications, image hosting platforms, and document processing systems-faces immediate risk of full system compromise if users or automated processes handle untrusted images. This requires urgent patching or isolation pending vendor remediation.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable JPEG processing in LibRaw or restrict to trusted image sources only; (2) Implement strict file upload validation (file type, size, and signature verification); (3) Run image processing in sandboxed/containerized environments with minimal privileges; (4) Segment systems handling user-supplied images from critical infrastructure; (5) Monitor for exploitation attempts targeting JPEG processing; (6) Consider temporary blocklisting of JPEG uploads until patch is released. Subscribe to LibRaw security advisories for patch notification.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Threat Intel
1
1 sources
Vendor Status
Publicly Disclosed:No
Exploited:No
Latest Software Release:Exploitation Less Likely
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment NCSC-NL MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

54
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: +5

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Related Vulnerabilities in LibRaw Buffer Overflow Vulnerabilities

View all 6
CVE-2026-20889 CRITICAL
9.8
CVE-2026-24660 HIGH
8.1
CVE-2026-20884 HIGH
8.1
CVE-2026-24450 HIGH
8.1
CVE-2026-20911 CRITICAL
9.8

More in Libraw

View all
CVE-2018-20337 HIGH POC
8.8 Dec 21

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Rated high

CVE-2013-2126 HIGH POC
7.5 Aug 14

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow cont
CVE-2020-24889 HIGH POC
7.8 Sep 16

A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp

CVE-2013-2127 HIGH POC
7.5 Aug 14

Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a de
CVE-2023-1729 MEDIUM POC
6.5 May 15

A flaw was found in LibRaw. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenticat
CVE-2020-15365 MEDIUM POC
6.5 Jun 28

LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomNam
CVE-2018-20365 MEDIUM POC
6.5 Dec 22

LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerabi
CVE-2018-20364 MEDIUM POC
6.5 Dec 22

LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Rated medium severity (CVSS 6.5),

CVE-2018-20363 MEDIUM POC
6.5 Dec 22

LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Rated medium severity (CVSS 6.5), t
CVE-2017-14265 CRITICAL
9.8 Sep 11

A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3.
CVE-2017-6886 CRITICAL
9.8 May 16

An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be expl
CVE-2017-6890 CRITICAL
9.8 May 15

A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-d

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2022-35737 HIGH POC
7.5
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-16651 HIGH POC
8.7

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-21413 ADVISORY https://ubuntu.com/security/notices/USN-8522-1 ADVISORY https://vuldb.com/vuln/355753 REF https://access.redhat.com/errata/RHSA-2026:11360 REF https://access.redhat.com/errata/RHSA-2026:13284 REF https://access.redhat.com/errata/RHSA-2026:13854 REF https://access.redhat.com/errata/RHSA-2026:13860 REF https://access.redhat.com/errata/RHSA-2026:13868 REF https://access.redhat.com/errata/RHSA-2026:13870 REF https://access.redhat.com/errata/RHSA-2026:14224 REF https://access.redhat.com/errata/RHSA-2026:14655 REF https://access.redhat.com/errata/RHSA-2026:14673 REF https://access.redhat.com/errata/RHSA-2026:19345 REF https://access.redhat.com/security/cve/CVE-2026-21413 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455929 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21413.json REF https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331 REF https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2331

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy