CVE-2026-5342: LibRaw out-of-bounds read in nikon_load_padded_packed_raw

CVE-2026-5342 · Severity: medium · CVSS 5.3 · Published 2026-04-02

LibRaw is a software library used by many applications to process RAW image files from digital cameras. A vulnerability was found that allows a specially crafted Nikon image file to cause the software to read memory outside of its intended boundaries. This could lead to application crashes or service disruptions when processing malicious images.

Technologies: Libraw. Vendors: Libraw.

Quick answers

Is CVE-2026-5342 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5342 being exploited in the wild.
How severe is CVE-2026-5342?
Medium severity, with a CVSS score of 5.3, published 2 April 2026.
Which products and versions are affected?
Libraw up to 0.22.0.
Is there a fix for CVE-2026-5342?
A patch was published on 2026-04-06: Version 0.22.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5342 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-5342?
Check whether you run Libraw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in LibRaw up to version 0.22.0 within the LibRaw::nikon_load_padded_packed_raw function in src/decoders/decoders_libraw.cpp. The root cause is a lack of validation between the load_flags metadata (used for buffer allocation) and the raw_width metadata (used to define the loop bounds for processing). An attacker can provide a crafted TIFF/NEF file where the width-derived access pattern exceeds the allocated buffer size, resulting in a heap-buffer-overflow. This can be exploited remotely if an application uses LibRaw to process untrusted user-supplied images. The issue is mitigated in version 0.22.1.

Affected products

  • LibRaw LibRaw up to 0.22.0

Timeline

  • 2026-03-16: disclosed: Issue reported on GitHub
  • 2026-04-02: advisory: NVD publication date
  • 2026-04-06: patched: Version 0.22.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.