p PatchFirst

CVE-2026-20884

CVE-2026-20884

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

CVSS 8.1 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libraw

    Versions
    • Commit 8dc68e2: Affected

    No fix published

  • libraw Debian:12

    Versions
    • 0.20.2-2.1
    • 0.20.2-2.1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 0.20.2-2.1+deb12u2

    Update to 0.20.2-2.1+deb12u2

  • libraw Debian:13

    Versions
    • 0.21.4-2
    Affected ranges
    • ECOSYSTEM: < 0.21.4-2+deb13u1

    Update to 0.21.4-2+deb13u1

  • libraw Debian:14

    Versions
    • 0.21.4-2
    • 0.21.4-3~exp1
    • 0.21.4-3~exp2
    • 0.21.5b-1
    • 0.22.0-1~exp1
    • 0.22.1-1~exp1
    • 0.22.1-1~exp2
    Affected ranges
    • ECOSYSTEM: < 0.22.1-1

    Update to 0.22.1-1

  • libraw Ubuntu:Pro:16.04:LTS

    Versions
    • 0.16.2-1
    • 0.17.0-1
    • 0.17.1-1
    • 0.17.1-1ubuntu0.1
    • 0.17.1-1ubuntu0.2
    • 0.17.1-1ubuntu0.3
    • 0.17.1-1ubuntu0.4
    • 0.17.1-1ubuntu0.5
    • 0.17.1-1ubuntu0.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • darktable Ubuntu:16.04:LTS

    Versions
    • 1.6.8-1
    • 1.6.9-1
    • 2.0.0-1
    • 2.0.1-1
    • 2.0.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dcraw Ubuntu:16.04:LTS

    Versions
    • 9.21-0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • digikam Ubuntu:Pro:16.04:LTS

    Versions
    • 4:4.12.0-0ubuntu5
    • 4:4.12.0-0ubuntu6
    • 4:4.12.0-0ubuntu7
    • 4:4.12.0-0ubuntu7+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • exactimage Ubuntu:16.04:LTS

    Versions
    • 0.9.1-6build1
    • 0.9.1-6ubuntu1
    • 0.9.1-8ubuntu1
    • 0.9.1-9
    • 0.9.1-9build1
    • 0.9.1-10
    • 0.9.1-11
    • 0.9.1-12
    • 0.9.1-12ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • kodi Ubuntu:16.04:LTS

    Versions
    • 15.1+dfsg1-3
    • 15.2+dfsg1-1build1
    • 15.2+dfsg1-3
    • 15.2+dfsg1-3ubuntu1
    • 15.2+dfsg1-3ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rawtherapee Ubuntu:16.04:LTS

    Versions
    • 4.2-2build1
    • 4.2-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ufraw Ubuntu:16.04:LTS

    Versions
    • 0.20-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libraw Ubuntu:Pro:18.04:LTS

    Versions
    • 0.18.2-2
    • 0.18.5-1
    • 0.18.7-2
    • 0.18.8-1
    • 0.18.8-1ubuntu0.1
    • 0.18.8-1ubuntu0.2
    • 0.18.8-1ubuntu0.3
    • 0.18.8-1ubuntu0.4
    • 0.18.8-1ubuntu0.4+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • digikam Ubuntu:Pro:18.04:LTS

    Versions
    • 4:5.6.0-0ubuntu2
    • 4:5.6.0-0ubuntu3
    • 4:5.6.0-0ubuntu4
    • 4:5.6.0-0ubuntu7
    • 4:5.6.0-0ubuntu8
    • 4:5.6.0-0ubuntu9
    • 4:5.6.0-0ubuntu10
    • 4:5.6.0-0ubuntu10+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rawtherapee Ubuntu:18.04:LTS

    Versions
    • 5.2-1
    • 5.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libraw Ubuntu:20.04:LTS

    Versions
    • 0.19.5-1
    • 0.19.5-1ubuntu1
    • 0.19.5-1ubuntu1.1
    • 0.19.5-1ubuntu1.2
    • 0.19.5-1ubuntu1.3
    • 0.19.5-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • darktable Ubuntu:20.04:LTS

    Versions
    • 2.6.0-1
    • 2.6.2-3
    • 2.6.3-1
    • 2.6.3-1build1
    • 2.6.3-1build2
    • 3.0.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dcraw Ubuntu:20.04:LTS

    Versions
    • 9.28-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • digikam Ubuntu:Pro:20.04:LTS

    Versions
    • 4:5.9.0-1ubuntu4
    • 4:6.4.0+dfsg-3
    • 4:6.4.0+dfsg-3build1
    • 4:6.4.0+dfsg-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • exactimage Ubuntu:20.04:LTS

    Versions
    • 1.0.2-3
    • 1.0.2-5ubuntu1
    • 1.0.2-5ubuntu2
    • 1.0.2-7ubuntu1
    • 1.0.2-7ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • kodi Ubuntu:20.04:LTS

    Versions
    • 2:17.6+dfsg1-4ubuntu4
    • 2:17.6+dfsg1-4ubuntu9
    • 2:17.6+dfsg1-4ubuntu10
    • 2:18.5+dfsg1-0ubuntu3
    • 2:18.6+dfsg1-2ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rawtherapee Ubuntu:20.04:LTS

    Versions
    • 5.6-1
    • 5.7-1
    • 5.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • darktable Ubuntu:22.04:LTS

    Versions
    • 3.6.0-0ubuntu1
    • 3.8.0-2
    • 3.8.0-3
    • 3.8.0-3build1
    • 3.8.0-3build2
    • 3.8.1-1
    • 3.8.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dcraw Ubuntu:22.04:LTS

    Versions
    • 9.28-2
    • 9.28-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →