CVE-2026-20889
Critical · 9.8CVSS
9.8
EPSS
0.8%
Published
Apr 7, 2026
CISA due date
—
The record
A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | libraw | 0 | 0.21.4-160000.3.1 |
| openSUSE:Tumbleweed | libraw | 0 | 0.22.1-1.1 |
Related vulnerabilities
- CVE-2026-24660 A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality… Also affects libraw
- CVE-2026-24450 An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw… Also affects libraw
- CVE-2026-21413 A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw… Also affects libraw
- CVE-2026-20884 An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of… Also affects libraw
- CVE-2026-20911 A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality… Also affects libraw
- CVE-2026-5342 A flaw has been found in LibRaw up to 0.22.0. Also affects libraw
- CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
- CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190