Back Linuxsecurity Ubuntu 26.04 LTS LibRaw High Denial of Service Vuln USN-8522
Several security issues were fixed in LibRaw. Software Description: - libraw: raw image decoder library Details: It was discovered that LibRaw incorrectly handled certain Nikon RAW image files. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service. (CVE-2026-5342) It was discovered that LibRaw had an integer overflow in its DNG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-20884) It was discovered that LibRaw incorrectly handled certain X3F thumbnail data. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-20889) It was discovered that LibRaw had a heap-based buffer overflow in its lossless JPEG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (C... Read the Full Advisory
Several security issues were fixed in LibRaw.
Software Description:
- libraw: raw image decoder library
It was discovered that LibRaw incorrectly handled certain Nikon RAW image
files. An attacker could possibly use this issue to cause LibRaw to crash,
resulting in a denial of service. (CVE-2026-5342)
It was discovered that LibRaw had an integer overflow in its DNG image
loader. An attacker could possibly use this issue to cause LibRaw to
crash, resulting in a denial of service, or execute arbitrary code.
It was discovered that LibRaw incorrectly handled certain X3F thumbnail
data. An attacker could possibly use this issue to cause LibRaw to crash,
resulting in a denial of service, or execute arbitrary code.
It was discovered that LibRaw had a heap-based buffer overflow in its
lossless JPEG image loader. An attacker could possibly use this issue to
cause LibRaw to crash, resulting in a denial of service, or execute
arbitrary code. (C...
The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libraw-bin 0.21.5b-1ubuntu1.1 libraw23t64 0.21.5b-1ubuntu1.1 Ubuntu 24.04 LTS libraw-bin 0.21.2-2.1ubuntu0.24.04.2 libraw23t64 0.21.2-2.1ubuntu0.24.04.2 Ubuntu 22.04 LTS libraw-bin 0.20.2-2ubuntu2.22.04.3 libraw20 0.20.2-2ubuntu2.22.04.3 In general, a standard system update will make all the necessary changes.
CVE-2026-20884, CVE-2026-20889, CVE-2026-21413, CVE-2026-24450,
Ubuntu Security Notice USN-8522-1
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
