Executive brief
LibRaw is a widely used software library for reading and processing RAW image files from digital cameras. A security flaw in how the library handles certain image data allows an attacker to crash applications or potentially execute malicious code by providing a specially crafted image file. This could lead to data theft, system compromise, or service disruptions for any application that uses this library to process user-uploaded photos.
Technical details
A heap-based buffer overflow exists in LibRaw's lossless JPEG decoder within the HuffTable::initval function in src/decompressors/losslessjpeg.cpp. The vulnerability is caused by an incorrect calculation of the Huffman lookup table size (CWE-131). The library fails to validate the 'bits' array provided in the image metadata before using it to determine the allocation size and subsequent write operations. An attacker can provide a malicious RAW image file with a crafted Huffman table structure that violates the Kraft inequality, causing the initialization loop to write past the end of the allocated heap buffer. This can be triggered remotely without authentication if an application processes untrusted image files using vulnerable versions of LibRaw.
Affected products
- LibRaw LibRaw Commit 0b56545, Commit d20315b, 0.22.0, 0.22.1
- Red Hat Enterprise Linux 6 affected
- Red Hat Enterprise Linux 7 affected
- Red Hat Enterprise Linux 8 affected
Timeline
- 2026-04-07: advisory: Initial advisory published by Talos and NVD
- 2026-06-29: other: Red Hat updated impact assessment for Enterprise Linux versions
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2330
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2330
- https://access.redhat.com/security/cve/CVE-2026-20911
- https://bugzilla.redhat.com/show_bug.cgi?id=2455959
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20911.json