CVE-2026-21413

LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading

View on CVE.org
Published Apr 7, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Description
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Analysis

AI-generated

Technical impact

A heap‑based buffer overflow exists in LibRaw’s lossless_jpeg_load_raw procedure. A specially crafted lossless JPEG file can overflow a heap buffer, allowing an attacker to execute arbitrary code in the context of the process that loads the file. The flaw is classified as CWE‑129 (Improper Validation of Array Index) and CWE‑787 (Out‑of‑Bounds Write).

Affected Systems

The vulnerability affects the LibRaw library, specifically versions 0.22.0 and 0.22.1. Any application that uses these LibRaw releases to process lossless JPEG images could be affected.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, while the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. The attack vector likely involves local or remote users who can supply a malicious image file to an application that relies on LibRaw for decoding. Successful exploitation would give the attacker code execution rights within the hosting process, potentially compromising entire systems.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade LibRaw to a version in which the buffer overflow is fixed, such as the latest stable release.
  • Verify that all dependent applications link against the updated library and restart them to ensure the patch takes effect.
  • If an update cannot be applied immediately, restrict or validate input files before they are handed to LibRaw and consider disabling lossless JPEG support where possible.

Generated by OpenCVE AI on April 10, 2026 at 22:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4704-1 libraw security update
Ubuntu USN Ubuntu USN USN-8522-1 LibRaw vulnerabilities
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:libraw:libraw:0.22.0:*:*:*:*:*:*:*
cpe:2.3:a:libraw:libraw:0.22.1:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Libraw
Libraw libraw
Vendors & Products Libraw
Libraw libraw
Type Values Removed Values Added
Title LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Weaknesses CWE-129
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Earlier changes (1)
Weaknesses
  • CWE-129

    Improper Validation of Array Index

  • CWE-787

    Out-of-bounds Write

Sources

Status
PUBLISHED
Assigner
talos
Published
Updated
Oct 13, 2026, 9:15 PM
Reserved
Jan 21, 2026, 4:26 PM

View source JSON

Updated
Apr 7, 2026, 4:23 PM

JSON

Status
Modified
Published
Apr 7, 2026, 3:17 PM
Modified
Oct 13, 2026, 10:17 PM

View source JSON

Severity
Important
Public date
Apr 7, 2026, 1:49 PM

View source Bugzilla JSON

Updated
Apr 13, 2026, 2:26 PM

JSON