# CVE-2026-24660: LibRaw heap buffer overflow in x3f_load_huffman

Source: https://junglewise.ai/threats/cve-2026-24660-libraw-heap-buffer-overflow-in-x3f-load-huffman  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-24660 · Severity: high · CVSS 8.1 · Published 2026-04-07

LibRaw is a widely used software library for processing RAW image files from digital cameras. A security flaw in how it handles specific Sigma/Foveon (X3F) image files could allow an attacker to crash an application or potentially execute malicious code by providing a specially crafted image. This risk primarily affects systems configured to process very large images with high memory limits.

Technologies: [Libraw](https://junglewise.ai/threats/technologies/libraw), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8). Vendors: [Libraw](https://junglewise.ai/threats/vendors/libraw), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-24660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24660 being exploited in the wild.

**How severe is CVE-2026-24660?** High severity, with a CVSS score of 8.1, published 7 April 2026.

**Which products and versions are affected?** Libraw Commit d20315b.

**Is there a fix for CVE-2026-24660?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24660 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24660?** Check whether you run Libraw, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in LibRaw's x3f_load_huffman() function within src/x3f/x3f_utils_patched.cpp. The vulnerability is caused by an integer overflow during the calculation of the pixel buffer size (columns * rows * 3) using 32-bit arithmetic. When processing an X3F file with attacker-controlled dimensions that cause this product to exceed UINT32_MAX, a smaller-than-required buffer is allocated via malloc(). Subsequent Huffman decompression writes data based on the original large dimensions, leading to out-of-bounds writes. Exploitation requires the library to be compiled with -DUSE_X3FTOOLS and the application to have a max_raw_memory_mb limit high enough (typically >11GB) to bypass standard memory checks.

## Affected products

- LibRaw LibRaw Commit d20315b
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8

## Timeline

- 2026-04-07: disclosed: Initial disclosure by Cisco Talos
- 2026-04-07: advisory

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2359](https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2359)
- [https://access.redhat.com/errata/RHSA-2026:13284](https://access.redhat.com/errata/RHSA-2026:13284)
- [https://access.redhat.com/errata/RHSA-2026:15924](https://access.redhat.com/errata/RHSA-2026:15924)
- [https://access.redhat.com/errata/RHSA-2026:15925](https://access.redhat.com/errata/RHSA-2026:15925)
- [https://access.redhat.com/errata/RHSA-2026:15926](https://access.redhat.com/errata/RHSA-2026:15926)
- [https://access.redhat.com/security/cve/CVE-2026-24660](https://access.redhat.com/security/cve/CVE-2026-24660)

## Related threats

- [LibRaw heap-based out-of-bounds read in Nikon makernote parsing](https://junglewise.ai/threats/cve-2026-111272-libraw-through-0-22-2-contains-a-heap-based-out-of-bounds-read)
- [LibRaw numeric conversion overflow in TIFF NewSubfileType parsing](https://junglewise.ai/threats/cve-2026-88387-libraw-0-22-0-contains-an-incorrect-numeric-conversion)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)