Heap-Based Buffer Overflow in LibRaw Affects Multiple Image Processing Applications
CVE-2026-24660

8.1HIGH

Key Information:

Vendor

Libraw

Status
Libraw
Vendor
CVE Published:
7 April 2026

What is CVE-2026-24660?

A heap-based buffer overflow vulnerability has been identified in the x3f_load_huffman functionality of LibRaw, specifically in Commit d20315b. This vulnerability allows attackers to exploit specially crafted malicious files, potentially leading to unauthorized access or the execution of arbitrary code. By manipulating the input data, an attacker can trigger this flaw, resulting in a heap buffer overflow that compromises the integrity and security of affected applications relying on LibRaw.

Affected Version(s)

LibRaw Commit d20315b

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Francesco Benvenuto of Cisco Talos.
.