CVE-2026-21413
Critical · 9.8CVSS
9.8
EPSS
1.4%
Published
Apr 7, 2026
CISA due date
—
The record
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | libraw | 0 | 0.21.4-160000.3.1 |
| openSUSE:Tumbleweed | libraw | 0 | 0.22.1-1.1 |
Related vulnerabilities
- CVE-2026-24660 A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality… Also affects libraw
- CVE-2026-24450 An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw… Also affects libraw
- CVE-2026-20884 An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of… Also affects libraw
- CVE-2026-20911 A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality… Also affects libraw
- CVE-2026-20889 A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality… Also affects libraw
- CVE-2026-5342 A flaw has been found in LibRaw up to 0.22.0. Also affects libraw
- CVE-2026-96675 alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM… CWE-129
- CVE-2026-84445 gRPC-Go is the Go language implementation of gRPC. CWE-129