# CVE-2026-20889: LibRaw heap buffer overflow in x3f_thumb_loader

Source: https://junglewise.ai/threats/cve-2026-20889-libraw-heap-buffer-overflow-in-x3f-thumb-loader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-20889 · Severity: critical · CVSS 9.8 · Published 2026-04-07

LibRaw is a widely used software library for processing RAW image files from digital cameras. A vulnerability in how it handles thumbnail images could allow an attacker to crash an application or potentially take control of a system by tricking a user or service into processing a specially crafted image file. This poses a significant risk to any software that uses LibRaw to display or process photos, such as image viewers, editors, or web services.

Technologies: [Libraw](https://junglewise.ai/threats/technologies/libraw). Vendors: [Libraw](https://junglewise.ai/threats/vendors/libraw).

## Quick answers

**Is CVE-2026-20889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20889 being exploited in the wild.

**How severe is CVE-2026-20889?** Critical severity, with a CVSS score of 9.8, published 7 April 2026.

**Which products and versions are affected?** Libraw Commit d20315b.

**Is there a fix for CVE-2026-20889?** A patch was published on 2026-04-06: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20889 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-20889?** Check whether you run Libraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the LibRaw::x3f_thumb_loader() function within src/x3f/x3f_parse_process.cpp. The vulnerability is caused by an integer overflow during the calculation of the thumbnail buffer size (columns * rows * 3) using 32-bit arithmetic. When processing attacker-controlled dimensions from a Sigma/Foveon X3F file, the product can exceed UINT32_MAX, leading to a small heap allocation via malloc(). Subsequent memmove() operations then write data based on the original large dimensions, resulting in a massive buffer overflow. This vulnerability requires LibRaw to be compiled with -DUSE_X3FTOOLS and can be triggered by providing a malicious X3F file to any application calling unpack_thumb().

## Affected products

- LibRaw LibRaw Commit d20315b
- Red Hat Enterprise Linux 8 0.19.5-6.el8_10

## Timeline

- 2026-02-12: disclosed: Initial vendor contact and disclosure
- 2026-04-06: patched: Vendor patch release
- 2026-04-07: advisory: Public release of Talos advisory and CVE publication
- 2026-05-04: patched: Red Hat security advisory RHSA-2026:13284 issued

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2358](https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2358)
- [https://access.redhat.com/errata/RHSA-2026:13284](https://access.redhat.com/errata/RHSA-2026:13284)
- [https://access.redhat.com/errata/RHSA-2026:14224](https://access.redhat.com/errata/RHSA-2026:14224)
- [https://access.redhat.com/errata/RHSA-2026:14655](https://access.redhat.com/errata/RHSA-2026:14655)
- [https://access.redhat.com/errata/RHSA-2026:14673](https://access.redhat.com/errata/RHSA-2026:14673)
- [https://access.redhat.com/security/cve/CVE-2026-20889](https://access.redhat.com/security/cve/CVE-2026-20889)

## Related threats

- [LibRaw heap-based out-of-bounds read in Nikon makernote parsing](https://junglewise.ai/threats/cve-2026-111272-libraw-through-0-22-2-contains-a-heap-based-out-of-bounds-read)
- [LibRaw numeric conversion overflow in TIFF NewSubfileType parsing](https://junglewise.ai/threats/cve-2026-88387-libraw-0-22-0-contains-an-incorrect-numeric-conversion)
- [LibRaw heap buffer overflow in stretch and fuji_rotate functions](https://junglewise.ai/threats/cve-2026-51235-libraw-heap-buffer-overflow-in-stretch-and-fuji-rotate-functions)
- [LibRaw heap buffer overflow in x3f_load_huffman](https://junglewise.ai/threats/cve-2026-24660-libraw-heap-buffer-overflow-in-x3f-load-huffman)
- [LibRaw heap buffer overflow in lossless_jpeg_load_raw](https://junglewise.ai/threats/cve-2026-21413-libraw-heap-buffer-overflow-in-lossless-jpeg-load-raw)