by Kastro CVE-2026-21413
LibRaw LibRaw — A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b.
Description · from the CVE record
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Affected
ProductAffectedFixed inSource
LibRawCommit 0b56545–CNA
LibRawCommit d20315b–CNA
Red Hat Enterprise Linux 8see advisory0:0.19.5-6.el8_10redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:0.19.5-2.el8_4.1redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:0.19.5-2.el8_4.1redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:0.19.5-3.el8_6.1redhat-SADP
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicesee advisory0:0.19.5-3.el8_6.1redhat-SADP
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionssee advisory0:0.19.5-3.el8_6.1redhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory0:0.19.5-3.el8_8.1redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory0:0.19.5-3.el8_8.1redhat-SADP
Red Hat Enterprise Linux 9see advisory0:0.21.1-2.el9_7redhat-SADP
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionssee advisory0:0.20.2-6.el9_0redhat-SADP
Scores by source
talos (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total