CVE-2026-21413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21413
Downstream
ALSA (3)
AZL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
JLSEC (1)
OESA (4)
openSUSE (2)
RHSA (10)
RLSA (3)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (3)
openSUSE (2)
SUSE (4)
Published
2026-04-07T13:49:29Z
Modified
2026-10-28T02:30:56Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Database specific 
{
    "cna_assigner":  "talos",
    "cwe_ids":  [
        "CWE-129"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21413.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "Commit 0b56545"
                        },
                        {
                            "last_affected":  "Commit 0b56545"
                        },
                        {
                            "introduced":  "Commit d20315b"
                        },
                        {
                            "last_affected":  "Commit d20315b"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/libraw/libraw

Affected ranges

Type
GIT
Repo
https://github.com/libraw/libraw
Events
Introduced
0b56545a4f828743f28a4345cdfdd4c49f9f9a2a
Last Affected
b860248a89d9082b8e0a1e202e516f46af9adb29
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:libraw:libraw:0.22.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0"
                },
                {
                    "last_affected":  "0.22.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:libraw:libraw:0.22.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.1"
                },
                {
                    "last_affected":  "0.22.1"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

0.*
0.22.0
0.22.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21413.json"