# CVE-2026-21413: LibRaw heap buffer overflow in lossless_jpeg_load_raw

Source: https://junglewise.ai/threats/cve-2026-21413-libraw-heap-buffer-overflow-in-lossless-jpeg-load-raw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-21413 · Severity: critical · CVSS 9.8 · Published 2026-04-07

LibRaw is a widely used software library for reading and processing RAW image files from digital cameras. A security vulnerability in how the library handles certain compressed image formats allows an attacker to crash applications or potentially execute malicious code by providing a specially crafted image file. This could lead to unauthorized access to data or a complete takeover of systems that automatically process user-uploaded photos.

Technologies: [Libraw](https://junglewise.ai/threats/technologies/libraw), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Libraw](https://junglewise.ai/threats/vendors/libraw), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-21413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21413 being exploited in the wild.

**How severe is CVE-2026-21413?** Critical severity, with a CVSS score of 9.8, published 7 April 2026.

**Which products and versions are affected?** Libraw Commit 0b56545, Commit d20315b; Red Hat Enterprise Linux AppStream 8, 9.

**Is there a fix for CVE-2026-21413?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-21413 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-21413?** Check whether you run Libraw or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in LibRaw's 'lossless_jpeg_load_raw' function within 'src/decoders/decoders_dcraw.cpp'. The vulnerability is caused by improper validation of the column index ('col') when processing JPEG-compressed RAW files (specifically Canon CR2 files using the CR2Slice tag). An attacker can control the 'cr2_slice' metadata values to calculate an out-of-bounds index for the 'raw_image' buffer. Because the attacker also controls the tone curve table and the JPEG bitstream, they can achieve a controlled 16-bit write to out-of-bounds heap memory. This can be triggered by providing a malicious image file to any application using LibRaw's 'unpack()' function.

## Affected products

- LibRaw LibRaw Commit 0b56545, Commit d20315b
- Red Hat Enterprise Linux AppStream 8, 9

## Timeline

- 2026-04-07: advisory: Initial advisory published by Talos and NVD

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2331](https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2331)
- [https://access.redhat.com/errata/RHSA-2026:11360](https://access.redhat.com/errata/RHSA-2026:11360)
- [https://access.redhat.com/errata/RHSA-2026:13284](https://access.redhat.com/errata/RHSA-2026:13284)
- [https://access.redhat.com/errata/RHSA-2026:13854](https://access.redhat.com/errata/RHSA-2026:13854)
- [https://access.redhat.com/errata/RHSA-2026:13860](https://access.redhat.com/errata/RHSA-2026:13860)
- [https://access.redhat.com/errata/RHSA-2026:13868](https://access.redhat.com/errata/RHSA-2026:13868)

## Related threats

- [LibRaw heap-based out-of-bounds read in Nikon makernote parsing](https://junglewise.ai/threats/cve-2026-111272-libraw-through-0-22-2-contains-a-heap-based-out-of-bounds-read)
- [LibRaw numeric conversion overflow in TIFF NewSubfileType parsing](https://junglewise.ai/threats/cve-2026-88387-libraw-0-22-0-contains-an-incorrect-numeric-conversion)
- [LibRaw heap buffer overflow in stretch and fuji_rotate functions](https://junglewise.ai/threats/cve-2026-51235-libraw-heap-buffer-overflow-in-stretch-and-fuji-rotate-functions)
- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)