Junglewise Threat Intelligence

CVE-2026-21413: LibRaw heap buffer overflow in lossless_jpeg_load_raw

CVE-2026-21413 · Severity: critical · CVSS 9.8 · Published 2026-04-07

Technologies: Red Hat Enterprise Linux AppStream, Libraw. Vendors: Red Hat, Libraw.

Executive brief

LibRaw is a widely used software library for reading and processing RAW image files from digital cameras. A security vulnerability in how the library handles certain compressed image formats allows an attacker to crash applications or potentially execute malicious code by providing a specially crafted image file. This could lead to unauthorized access to data or a complete takeover of systems that automatically process user-uploaded photos.

Technical details

A heap-based buffer overflow exists in LibRaw's 'lossless_jpeg_load_raw' function within 'src/decoders/decoders_dcraw.cpp'. The vulnerability is caused by improper validation of the column index ('col') when processing JPEG-compressed RAW files (specifically Canon CR2 files using the CR2Slice tag). An attacker can control the 'cr2_slice' metadata values to calculate an out-of-bounds index for the 'raw_image' buffer. Because the attacker also controls the tone curve table and the JPEG bitstream, they can achieve a controlled 16-bit write to out-of-bounds heap memory. This can be triggered by providing a malicious image file to any application using LibRaw's 'unpack()' function.

Affected products

  • LibRaw LibRaw Commit 0b56545, Commit d20315b
  • Red Hat Enterprise Linux AppStream 8, 9

Timeline

  • 2026-04-07: advisory: Initial advisory published by Talos and NVD

References

Related threats