kritisch
CVE-2026-24660
LibRaw: LibRaw: Memory Corruption via Malicious File Processing
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | LibRaw, LibRaw-devel | 0.19.5-6.el8_10 |
| alpine 3.24 | libraw | 0.22.1-r0 |
| alpine edge | libraw | 0.22.1-r0 |
| amazon linux 2 | LibRaw, LibRaw-debuginfo, LibRaw-devel und 1 weitere | 0.19.4-1.amzn2.0.8 |
| debian 11 | libraw | 0.20.2-1+deb11u3 |
| debian 12 | libraw | 0.20.2-2.1+deb12u2 |
| debian 13 | libraw | 0.21.4-2+deb13u1 |
| debian 14 | libraw | 0.22.1-1 |
| echo | libraw | 0.20.2-2.1+deb12u2 |
| Oracle Linux 8 | LibRaw, LibRaw-devel | 0.19.5-6.el8_10 |
| rapidfort debian 12 | libraw, rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 13 | libraw, rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
Alle 48 Einträge aus 24 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | LibRaw | 0.19.5-6.el8_10 |
| alma 8 | LibRaw-devel | 0.19.5-6.el8_10 |
| alpine 3.24 | libraw | 0.22.1-r0 |
| alpine edge | libraw | 0.22.1-r0 |
| amazon linux 2 | LibRaw | 0.19.4-1.amzn2.0.8 |
| amazon linux 2 | LibRaw-debuginfo | 0.19.4-1.amzn2.0.8 |
| amazon linux 2 | LibRaw-devel | 0.19.4-1.amzn2.0.8 |
| amazon linux 2 | LibRaw-static | 0.19.4-1.amzn2.0.8 |
| debian 11 | libraw | 0.20.2-1+deb11u3 |
| debian 12 | libraw | 0.20.2-2.1+deb12u2 |
| debian 13 | libraw | 0.21.4-2+deb13u1 |
| debian 14 | libraw | 0.22.1-1 |
| echo | libraw | 0.20.2-2.1+deb12u2 |
| Oracle Linux 8 | LibRaw | 0.19.5-6.el8_10 |
| Oracle Linux 8 | LibRaw-devel | 0.19.5-6.el8_10 |
| rapidfort debian 12 | libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 12 | rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 13 | libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 13 | rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort fedora 43 | darktable | 5.6.1-2.fc43 |
| rapidfort fedora 43 | darktable-tools-basecurve | 5.6.1-2.fc43 |
| rapidfort fedora 43 | darktable-tools-noise | 5.6.1-2.fc43 |
| rapidfort fedora 43 | mingw-LibRaw | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw32-LibRaw | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw32-LibRaw-static | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw32-LibRaw-tools | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw64-LibRaw | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw64-LibRaw-static | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw64-LibRaw-tools | 0.21.5-2.fc43 |
| rapidfort ubuntu 20.04 | libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 20.04 | rf-libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 22.04 | libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 22.04 | rf-libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 24.04 | libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 24.04 | rf-libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| Red Hat | LibRaw | kein Fix angegeben |
| Red Hat | LibRaw-devel | kein Fix angegeben |
| Red Hat | LibRaw-static | kein Fix angegeben |
| Red Hat | libraw1394 | kein Fix angegeben |
| Red Hat | libraw1394-devel | kein Fix angegeben |
| rocky 8 | LibRaw | 0.19.5-6.el8_10 |
| root.io debian 13 | libraw | 0.21.4-2.root.io.1 |
| root.io debian 13 | rootio-libraw | 0.21.4-2.root.io.1 |
| ubuntu 18.04-ESM | libraw | kein Fix angegeben |
| ubuntu 20.04-ESM | libraw | kein Fix angegeben |
| ubuntu 22.04 | libraw | 0.20.2-2ubuntu2.22.04.3 |
| ubuntu 24.04 | libraw | 0.21.2-2.1ubuntu0.24.04.2 |
| ubuntu 26.04 | libraw | 0.21.5b-1ubuntu1.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:13284
- https://access.redhat.com/errata/RHSA-2026:15924
- https://access.redhat.com/errata/RHSA-2026:15925
- https://access.redhat.com/errata/RHSA-2026:15926
- https://access.redhat.com/security/cve/CVE-2026-24660
- https://bugzilla.redhat.com/2455926
- https://bugzilla.redhat.com/2455929
- https://bugzilla.redhat.com/2455942
Alle 25 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2455926
- https://bugzilla.redhat.com/show_bug.cgi?id=2455929
- https://bugzilla.redhat.com/show_bug.cgi?id=2455942
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20889
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21413
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24660
- https://errata.almalinux.org/8/ALSA-2026-13284.html
- https://errata.rockylinux.org/RLSA-2026:13284
- https://linux.oracle.com/cve/CVE-2026-24660.html
- https://linux.oracle.com/errata/ELSA-2026-13284.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-24660
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24660.json
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359
- https://ubuntu.com/security/notices/USN-8522-1
- https://www.cve.org/CVERecord?id=CVE-2026-24660
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2359