CVE-2026-5342
- Source
- https://cve.org/CVERecord?id=CVE-2026-5342
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5342.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-5342
- Downstream
AZL (1)
DEBIAN (1)
ECHO (1)
JLSEC (1)
openSUSE (2)
ROOT (1)
UBUNTU (1)
- Related
- Published
- 2026-04-02T14:30:14Z
- Modified
- 2026-10-28T10:51:58Z
- Severity
-
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds
- Details
-
A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-119", "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5342.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "0.1" }, { "last_affected": "0.1" }, { "introduced": "0.2" }, { "last_affected": "0.2" }, { "introduced": "0.3" }, { "last_affected": "0.3" }, { "introduced": "0.4" }, { "last_affected": "0.4" }, { "introduced": "0.5" }, { "last_affected": "0.5" }, { "introduced": "0.6" }, { "last_affected": "0.6" }, { "introduced": "0.7" }, { "last_affected": "0.7" }, { "introduced": "0.8" }, { "last_affected": "0.8" }, { "introduced": "0.9" }, { "last_affected": "0.9" }, { "introduced": "0.10" }, { "last_affected": "0.10" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" } ] } ] }- References
-
- https://github.com/LibRaw/LibRaw/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5342.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-5342
- https://vuldb.com/submit/781223
- https://vuldb.com/vuln/354671
- https://github.com/LibRaw/LibRaw/issues/795
- https://github.com/LibRaw/LibRaw/issues/795#issuecomment-4073769886
- https://vuldb.com/vuln/354671/cti
- https://github.com/LibRaw/LibRaw/commit/b8397cd45657b84e88bd1202528d1764265f185c
- https://github.com/LibRaw/LibRaw/releases/tag/0.22.1
- https://github.com/biniamf/pocs/tree/main/libraw_nikonpadded
Affected packages
Git / github.com/libraw/libraw
Affected ranges
- Type
- GIT
- Repo
- https://github.com/libraw/libraw
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.11" }, { "last_affected": "0.11" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.12" }, { "last_affected": "0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.13" }, { "last_affected": "0.13" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.14" }, { "last_affected": "0.14" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.15" }, { "last_affected": "0.15" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.16" }, { "last_affected": "0.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.17" }, { "last_affected": "0.17" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.18" }, { "last_affected": "0.18" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.19" }, { "last_affected": "0.19" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.20" }, { "last_affected": "0.20" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.21" }, { "last_affected": "0.21" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.22.0" }, { "last_affected": "0.22.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "b8397cd45657b84e88bd1202528d1764265f185c" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "0.22.1", "range": [ { "fixed": "b860248a89d9082b8e0a1e202e516f46af9adb29" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5342.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "75762778109458427875769868541149481938",
"length": 18461
},
"id": "CVE-2026-5342-1c5ba764",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/libraw/libraw/commit/b8397cd45657b84e88bd1202528d1764265f185c",
"target": {
"file": "src/metadata/tiff.cpp",
"function": "LibRaw::apply_tiff"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84981703727095246191539248690892626236",
"length": 1156
},
"id": "CVE-2026-5342-313d2854",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/libraw/libraw/commit/b8397cd45657b84e88bd1202528d1764265f185c",
"target": {
"file": "src/decoders/decoders_libraw.cpp",
"function": "LibRaw::nikon_load_padded_packed_raw"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"28244586361528992352522152194319482398",
"92157897365039769988828882281683992520",
"249419145314412054435341265046189754782",
"147838370502341082218215597431389232700",
"268852207816429060776474755319238157629",
"19833769672006721639578250071944379213",
"108147390792519766460047328957182456943",
"193998266684608617211010662832227538321",
"9342119849890528820223737516730364104",
"138232008353031034202073290338649308539",
"132295669638616007946044778428761391761",
"51145738289976052827562857012528571353",
"279545017355210863464581914152843540103",
"126576192636509665505602364602811841240",
"100569988196465285714214852750654529770",
"276122923454765561941918136488648270401",
"35727505169355187103433350353149522185"
],
"threshold": 0.9
},
"id": "CVE-2026-5342-33412754",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/libraw/libraw/commit/b8397cd45657b84e88bd1202528d1764265f185c",
"target": {
"file": "src/decoders/decoders_libraw.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"237739710694465869779659605822927391528",
"284840264059880553985438553535815150122",
"193763208134149196329007091648312408011",
"16778219902612833982178182206358732840",
"256008877216685110381393122834397204954"
],
"threshold": 0.9
},
"id": "CVE-2026-5342-ce793a40",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/libraw/libraw/commit/b8397cd45657b84e88bd1202528d1764265f185c",
"target": {
"file": "src/metadata/tiff.cpp"
}
}
]
vanir_signatures_modified
"2026-10-28T10:51:58Z"