CVE-2026-21413
CVE-2026-21413
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS 9.8 · Critical · EPSS 1.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libraw
- Versions
- Commit 0b56545: Affected
- Commit d20315b: Affected
No fix published
libraw Debian:12
- Versions
- 0.20.2-2.1
- 0.20.2-2.1+deb12u1
- Affected ranges
- ECOSYSTEM: < 0.20.2-2.1+deb12u2
Update to 0.20.2-2.1+deb12u2
libraw Debian:13
- Versions
- 0.21.4-2
- Affected ranges
- ECOSYSTEM: < 0.21.4-2+deb13u1
Update to 0.21.4-2+deb13u1
libraw Debian:14
- Versions
- 0.21.4-2
- 0.21.4-3~exp1
- 0.21.4-3~exp2
- 0.21.5b-1
- 0.22.0-1~exp1
- 0.22.1-1~exp1
- 0.22.1-1~exp2
- Affected ranges
- ECOSYSTEM: < 0.22.1-1
Update to 0.22.1-1
libraw Ubuntu:Pro:16.04:LTS
- Versions
- 0.16.2-1
- 0.17.0-1
- 0.17.1-1
- 0.17.1-1ubuntu0.1
- 0.17.1-1ubuntu0.2
- 0.17.1-1ubuntu0.3
- 0.17.1-1ubuntu0.4
- 0.17.1-1ubuntu0.5
- 0.17.1-1ubuntu0.5+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
darktable Ubuntu:16.04:LTS
- Versions
- 1.6.8-1
- 1.6.9-1
- 2.0.0-1
- 2.0.1-1
- 2.0.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dcraw Ubuntu:16.04:LTS
- Versions
- 9.21-0.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
digikam Ubuntu:Pro:16.04:LTS
- Versions
- 4:4.12.0-0ubuntu5
- 4:4.12.0-0ubuntu6
- 4:4.12.0-0ubuntu7
- 4:4.12.0-0ubuntu7+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
exactimage Ubuntu:16.04:LTS
- Versions
- 0.9.1-6build1
- 0.9.1-6ubuntu1
- 0.9.1-8ubuntu1
- 0.9.1-9
- 0.9.1-9build1
- 0.9.1-10
- 0.9.1-11
- 0.9.1-12
- 0.9.1-12ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
kodi Ubuntu:16.04:LTS
- Versions
- 15.1+dfsg1-3
- 15.2+dfsg1-1build1
- 15.2+dfsg1-3
- 15.2+dfsg1-3ubuntu1
- 15.2+dfsg1-3ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:16.04:LTS
- Versions
- 4.2-2build1
- 4.2-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ufraw Ubuntu:16.04:LTS
- Versions
- 0.20-3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libraw Ubuntu:Pro:18.04:LTS
- Versions
- 0.18.2-2
- 0.18.5-1
- 0.18.7-2
- 0.18.8-1
- 0.18.8-1ubuntu0.1
- 0.18.8-1ubuntu0.2
- 0.18.8-1ubuntu0.3
- 0.18.8-1ubuntu0.4
- 0.18.8-1ubuntu0.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
darktable Ubuntu:18.04:LTS
- Versions
- 2.2.5-2
- 2.4.0-1
- 2.4.1-1
- 2.4.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dcraw Ubuntu:18.04:LTS
- Versions
- 9.27-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
digikam Ubuntu:Pro:18.04:LTS
- Versions
- 4:5.6.0-0ubuntu2
- 4:5.6.0-0ubuntu3
- 4:5.6.0-0ubuntu4
- 4:5.6.0-0ubuntu7
- 4:5.6.0-0ubuntu8
- 4:5.6.0-0ubuntu9
- 4:5.6.0-0ubuntu10
- 4:5.6.0-0ubuntu10+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
exactimage Ubuntu:18.04:LTS
- Versions
- 0.9.2-1build1
- 1.0.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
kodi Ubuntu:18.04:LTS
- Versions
- 2:17.3+dfsg1-3
- 2:17.3+dfsg1-3build1
- 2:17.3+dfsg1-5
- 2:17.3+dfsg1-5build1
- 2:17.3+dfsg1-5build2
- 2:17.6+dfsg1-1
- 2:17.6+dfsg1-1build1
- 2:17.6+dfsg1-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:18.04:LTS
- Versions
- 5.2-1
- 5.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ufraw Ubuntu:18.04:LTS
- Versions
- 0.22-1.1
- 0.22-2
- 0.22-3
- 0.22-3.1~build0.18.04.1
- 0.22-3.1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libraw Ubuntu:20.04:LTS
- Versions
- 0.19.5-1
- 0.19.5-1ubuntu1
- 0.19.5-1ubuntu1.1
- 0.19.5-1ubuntu1.2
- 0.19.5-1ubuntu1.3
- 0.19.5-1ubuntu1.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
darktable Ubuntu:20.04:LTS
- Versions
- 2.6.0-1
- 2.6.2-3
- 2.6.3-1
- 2.6.3-1build1
- 2.6.3-1build2
- 3.0.1-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dcraw Ubuntu:20.04:LTS
- Versions
- 9.28-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
digikam Ubuntu:Pro:20.04:LTS
- Versions
- 4:5.9.0-1ubuntu4
- 4:6.4.0+dfsg-3
- 4:6.4.0+dfsg-3build1
- 4:6.4.0+dfsg-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2331
- https://access.redhat.com/security/cve/CVE-2026-21413
- https://bugzilla.redhat.com/show_bug.cgi?id=2455929
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21413.json
- https://access.redhat.com/errata/RHSA-2026:13284
- https://access.redhat.com/errata/RHSA-2026:14224
- https://access.redhat.com/errata/RHSA-2026:14655
- https://access.redhat.com/errata/RHSA-2026:14673
- https://access.redhat.com/errata/RHSA-2026:13860
- https://access.redhat.com/errata/RHSA-2026:13868
- https://access.redhat.com/errata/RHSA-2026:13870
- https://access.redhat.com/errata/RHSA-2026:13854
- https://access.redhat.com/errata/RHSA-2026:11360
- https://access.redhat.com/errata/RHSA-2026:19345
- https://nvd.nist.gov/vuln/detail/CVE-2026-21413