CVE-2026-20889

CRITICAL

LibRaw Commit d20315b - Heap-Based Buffer Overflow in x3f_thumb_loader

Title source: llm
STIX 2.1

Description

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0050
EPSS Percentile 38.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-190
Status published
Products (2)
libraw/libraw 0.22.0
LibRaw/LibRaw Commit d20315b
Published Apr 07, 2026
Tracked Since Apr 07, 2026