Is CVE-2026-20889 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20889 being exploited in the wild.

How severe is CVE-2026-20889?

Critical severity, with a CVSS score of 9.8, published 7 April 2026.

Is there a fix for CVE-2026-20889?

A patch was published on 2026-04-06: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20889 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-20889?

Check whether you run Libraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20889: LibRaw heap buffer overflow in x3f_thumb_loader

CVE-2026-20889 · Severity: critical · CVSS 9.8 · Published 2026-04-07

LibRaw is a widely used software library for processing RAW image files from digital cameras. A vulnerability in how it handles thumbnail images could allow an attacker to crash an application or potentially take control of a system by tricking a user or service into processing a specially crafted image file. This poses a significant risk to any software that uses LibRaw to display or process photos, such as image viewers, editors, or web services.

Technologies: Libraw. Vendors: Libraw.

Quick answers

Is CVE-2026-20889 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20889 being exploited in the wild.
How severe is CVE-2026-20889?: Critical severity, with a CVSS score of 9.8, published 7 April 2026.
Which products and versions are affected?: Libraw Commit d20315b.
Is there a fix for CVE-2026-20889?: A patch was published on 2026-04-06: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20889 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-20889?: Check whether you run Libraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the LibRaw::x3f_thumb_loader() function within src/x3f/x3f_parse_process.cpp. The vulnerability is caused by an integer overflow during the calculation of the thumbnail buffer size (columns * rows * 3) using 32-bit arithmetic. When processing attacker-controlled dimensions from a Sigma/Foveon X3F file, the product can exceed UINT32_MAX, leading to a small heap allocation via malloc(). Subsequent memmove() operations then write data based on the original large dimensions, resulting in a massive buffer overflow. This vulnerability requires LibRaw to be compiled with -DUSE_X3FTOOLS and can be triggered by providing a malicious X3F file to any application calling unpack_thumb().

Affected products

LibRaw LibRaw Commit d20315b
Red Hat Enterprise Linux 8 0.19.5-6.el8_10

Timeline

2026-02-12: disclosed: Initial vendor contact and disclosure
2026-04-06: patched: Vendor patch release
2026-04-07: advisory: Public release of Talos advisory and CVE publication
2026-05-04: patched: Red Hat security advisory RHSA-2026:13284 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.