Home / mailings

PDF

[USN-8522-1] LibRaw vulnerabilities

Posted on 09 July 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8522-1
July 09, 2026

libraw vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in LibRaw.

Software Description:
- libraw: raw image decoder library

Details:

It was discovered that LibRaw incorrectly handled certain Nikon RAW image
files. An attacker could possibly use this issue to cause LibRaw to crash,
resulting in a denial of service. (CVE-2026-5342)

It was discovered that LibRaw had an integer overflow in its DNG image
loader. An attacker could possibly use this issue to cause LibRaw to
crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-20884)

It was discovered that LibRaw incorrectly handled certain X3F thumbnail
data. An attacker could possibly use this issue to cause LibRaw to crash,
resulting in a denial of service, or execute arbitrary code.
(CVE-2026-20889)

It was discovered that LibRaw had a heap-based buffer overflow in its
lossless JPEG image loader. An attacker could possibly use this issue to
cause LibRaw to crash, resulting in a denial of service, or execute
arbitrary code. (CVE-2026-21413)

It was discovered that LibRaw had an integer overflow in its uncompressed
floating-point DNG image loader. An attacker could possibly use this issue
to cause LibRaw to crash, resulting in a denial of service, or execute
arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.04.
(CVE-2026-24450)

It was discovered that LibRaw had a heap-based buffer overflow in its X3F
Huffman decoder. An attacker could possibly use this issue to cause LibRaw
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-24660)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
libraw-bin 0.21.5b-1ubuntu1.1
libraw23t64 0.21.5b-1ubuntu1.1

Ubuntu 24.04 LTS
libraw-bin 0.21.2-2.1ubuntu0.24.04.2
libraw23t64 0.21.2-2.1ubuntu0.24.04.2

Ubuntu 22.04 LTS
libraw-bin 0.20.2-2ubuntu2.22.04.3
libraw20 0.20.2-2ubuntu2.22.04.3

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8522-1
CVE-2026-20884, CVE-2026-20889, CVE-2026-21413, CVE-2026-24450,
CVE-2026-24660, CVE-2026-5342

Package Information:
https://launchpad.net/ubuntu/+source/libraw/0.21.5b-1ubuntu1.1
https://launchpad.net/ubuntu/+source/libraw/0.21.2-2.1ubuntu0.24.04.2
https://launchpad.net/ubuntu/+source/libraw/0.20.2-2ubuntu2.22.04.3

--===============2637129445532021763==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP