by Kastro CVE-2026-20889
LibRaw LibRaw — A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b.
Description · from the CVE record
A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Affected
ProductAffectedFixed inSource
LibRawCommit d20315b–CNA
Red Hat Enterprise Linux 8see advisory0:0.19.5-6.el8_10redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:0.19.5-2.el8_4.1redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:0.19.5-2.el8_4.1redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:0.19.5-3.el8_6.1redhat-SADP
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicesee advisory0:0.19.5-3.el8_6.1redhat-SADP
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionssee advisory0:0.19.5-3.el8_6.1redhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory0:0.19.5-3.el8_8.1redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory0:0.19.5-3.el8_8.1redhat-SADP
Red Hat Enterprise Linux 6see advisory–redhat-SADP
Red Hat Enterprise Linux 7see advisory–redhat-SADP
Red Hat Enterprise Linux 7see advisory–redhat-SADP
Scores by source
talos (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total