CVE-2026-24660: LibRaw heap buffer overflow in x3f_load_huffman

CVE-2026-24660 · Severity: high · CVSS 8.1 · Published 2026-04-07

LibRaw is a widely used software library for processing RAW image files from digital cameras. A security flaw in how it handles specific Sigma/Foveon (X3F) image files could allow an attacker to crash an application or potentially execute malicious code by providing a specially crafted image. This risk primarily affects systems configured to process very large images with high memory limits.

Technologies: Libraw, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8. Vendors: Libraw, Red Hat.

Quick answers

Is CVE-2026-24660 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24660 being exploited in the wild.
How severe is CVE-2026-24660?
High severity, with a CVSS score of 8.1, published 7 April 2026.
Which products and versions are affected?
Libraw Commit d20315b.
Is there a fix for CVE-2026-24660?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24660 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-24660?
Check whether you run Libraw, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in LibRaw's x3f_load_huffman() function within src/x3f/x3f_utils_patched.cpp. The vulnerability is caused by an integer overflow during the calculation of the pixel buffer size (columns * rows * 3) using 32-bit arithmetic. When processing an X3F file with attacker-controlled dimensions that cause this product to exceed UINT32_MAX, a smaller-than-required buffer is allocated via malloc(). Subsequent Huffman decompression writes data based on the original large dimensions, leading to out-of-bounds writes. Exploitation requires the library to be compiled with -DUSE_X3FTOOLS and the application to have a max_raw_memory_mb limit high enough (typically >11GB) to bypass standard memory checks.

Affected products

  • LibRaw LibRaw Commit d20315b
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8

Timeline

  • 2026-04-07: disclosed: Initial disclosure by Cisco Talos
  • 2026-04-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.