Libraw EUVD-2026-19626

Attacker must provide a specially crafted malicious DNG image file to LibRaw commit 8dc68e2. Vulnerability triggered during uncompressed_fp_dng_load_raw parsing. Remote delivery possible; no authentication or user interaction required beyond file processing by vulnerable application.

Despite the high CVSS score of 8.1, real-world exploitability requires careful consideration of multiple factors. The attack vector is network-based (AV:N), enabling remote exploitation without physical access, but attack complexity is high (AC:H), suggesting successful exploitation demands precise crafting of malicious DNG files and potentially specific environmental conditions. No user interaction is required (UI:N) once the malicious file reaches the processing pipeline, which elevates risk in automated image processing systems, content delivery networks, or server-side thumbnail generation services. The vulnerability requires no authentication (PR:N), broadening the attack surface to any system accepting DNG uploads from untrusted sources. EPSS data is not available for this recent CVE, and it is not listed in CISA's KEV catalog, indicating no confirmed active exploitation. Cisco Talos's public disclosure provides detailed technical analysis that could accelerate weaponization by sophisticated threat actors. The SSVC technical impact is high given potential for arbitrary code execution, but exploitation status remains proof-of-concept at best. Organizations using LibRaw in server-side image processing pipelines face higher risk than desktop applications where user awareness provides a layer of defense. This is a genuine priority for systems processing untrusted image files, particularly in automated workflows, but may be lower priority for isolated desktop deployments with trusted image sources.

An attacker crafts a malicious DNG file with carefully manipulated header fields specifying image dimensions that trigger integer overflow during size calculation in uncompressed_fp_dng_load_raw. The attacker uploads this file to a photography website's image processing service or sends it via email to a target using vulnerable image management software. When the application processes the DNG file through LibRaw, the integer overflow causes allocation of an undersized heap buffer, followed by writing of full image data that overflows the buffer. The attacker achieves arbitrary code execution in the context of the image processing service, potentially gaining control of the server, accessing stored images and user data, or pivoting to internal networks. The high attack complexity suggests exploitation requires deep understanding of DNG format internals and heap manipulation techniques, but publicly available exploit code exists per Cisco Talos research, lowering the barrier for capable adversaries.