Junglewise Threat Intelligence

CVE-2026-24660: LibRaw heap buffer overflow in x3f_load_huffman

CVE-2026-24660 · Severity: high · CVSS 8.1 · Published 2026-04-07

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Libraw. Vendors: Red Hat, Libraw.

Executive brief

LibRaw is a widely used software library for processing RAW image files from digital cameras. A security flaw in how it handles specific Sigma/Foveon (X3F) image files could allow an attacker to crash an application or potentially execute malicious code by providing a specially crafted image. This risk primarily affects systems configured to process very large images with high memory limits.

Technical details

A heap-based buffer overflow exists in LibRaw's x3f_load_huffman() function within src/x3f/x3f_utils_patched.cpp. The vulnerability is caused by an integer overflow during the calculation of the pixel buffer size (columns * rows * 3) using 32-bit arithmetic. When processing an X3F file with attacker-controlled dimensions that cause this product to exceed UINT32_MAX, a smaller-than-required buffer is allocated via malloc(). Subsequent Huffman decompression writes data based on the original large dimensions, leading to out-of-bounds writes. Exploitation requires the library to be compiled with -DUSE_X3FTOOLS and the application to have a max_raw_memory_mb limit high enough (typically >11GB) to bypass standard memory checks.

Affected products

  • LibRaw LibRaw Commit d20315b
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8

Timeline

  • 2026-04-07: disclosed: Initial disclosure by Cisco Talos
  • 2026-04-07: advisory

References

Related threats