Junglewise Threat Intelligence

CVE-2026-20889: LibRaw heap buffer overflow in x3f_thumb_loader

CVE-2026-20889 · Severity: critical · CVSS 9.8 · Published 2026-04-07

Technologies: Red Hat Enterprise Linux 8, Libraw. Vendors: Red Hat, Libraw.

Executive brief

LibRaw is a widely used software library for processing RAW image files from digital cameras. A vulnerability in how it handles thumbnail images could allow an attacker to crash an application or potentially take control of a system by tricking a user or service into processing a specially crafted image file. This poses a significant risk to any software that uses LibRaw to display or process photos, such as image viewers, editors, or web services.

Technical details

A heap-based buffer overflow exists in the LibRaw::x3f_thumb_loader() function within src/x3f/x3f_parse_process.cpp. The vulnerability is caused by an integer overflow during the calculation of the thumbnail buffer size (columns * rows * 3) using 32-bit arithmetic. When processing attacker-controlled dimensions from a Sigma/Foveon X3F file, the product can exceed UINT32_MAX, leading to a small heap allocation via malloc(). Subsequent memmove() operations then write data based on the original large dimensions, resulting in a massive buffer overflow. This vulnerability requires LibRaw to be compiled with -DUSE_X3FTOOLS and can be triggered by providing a malicious X3F file to any application calling unpack_thumb().

Affected products

  • LibRaw LibRaw Commit d20315b
  • Red Hat Enterprise Linux 8 0.19.5-6.el8_10

Timeline

  • 2026-02-12: disclosed: Initial vendor contact and disclosure
  • 2026-04-06: patched: Vendor patch release
  • 2026-04-07: advisory: Public release of Talos advisory and CVE publication
  • 2026-05-04: patched: Red Hat security advisory RHSA-2026:13284 issued

References

Related threats