Integer Overflow Vulnerability in LibRaw Affects Multiple Applications
CVE-2026-20884

8.1HIGH

Key Information:

Vendor

Libraw

Status
Libraw
Vendor
CVE Published:
7 April 2026

What is CVE-2026-20884?

An integer overflow vulnerability in the deflate_dng_load_raw function of LibRaw allows for potential exploitation through specially crafted files. This issue could lead to a heap buffer overflow, enabling attackers to execute malicious code or disrupt service. Proper validation and handling of file data are crucial for preventing such vulnerabilities.

Affected Version(s)

LibRaw Commit 8dc68e2

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Francesco Benvenuto of Cisco Talos.
.