crítica
CVE-2026-24660
LibRaw: LibRaw: Memory Corruption via Malicious File Processing
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | LibRaw, LibRaw-devel | 0.19.5-6.el8_10 |
| alpine 3.24 | libraw | 0.22.1-r0 |
| alpine edge | libraw | 0.22.1-r0 |
| amazon linux 2 | LibRaw, LibRaw-debuginfo, LibRaw-devel y 1 más | 0.19.4-1.amzn2.0.8 |
| debian 11 | libraw | 0.20.2-1+deb11u3 |
| debian 12 | libraw | 0.20.2-2.1+deb12u2 |
| debian 13 | libraw | 0.21.4-2+deb13u1 |
| debian 14 | libraw | 0.22.1-1 |
| echo | libraw | 0.20.2-2.1+deb12u2 |
| Oracle Linux 8 | LibRaw, LibRaw-devel | 0.19.5-6.el8_10 |
| rapidfort debian 12 | libraw, rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 13 | libraw, rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
Mostrar las 48 entradas de 24 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | LibRaw | 0.19.5-6.el8_10 |
| alma 8 | LibRaw-devel | 0.19.5-6.el8_10 |
| alpine 3.24 | libraw | 0.22.1-r0 |
| alpine edge | libraw | 0.22.1-r0 |
| amazon linux 2 | LibRaw | 0.19.4-1.amzn2.0.8 |
| amazon linux 2 | LibRaw-debuginfo | 0.19.4-1.amzn2.0.8 |
| amazon linux 2 | LibRaw-devel | 0.19.4-1.amzn2.0.8 |
| amazon linux 2 | LibRaw-static | 0.19.4-1.amzn2.0.8 |
| debian 11 | libraw | 0.20.2-1+deb11u3 |
| debian 12 | libraw | 0.20.2-2.1+deb12u2 |
| debian 13 | libraw | 0.21.4-2+deb13u1 |
| debian 14 | libraw | 0.22.1-1 |
| echo | libraw | 0.20.2-2.1+deb12u2 |
| Oracle Linux 8 | LibRaw | 0.19.5-6.el8_10 |
| Oracle Linux 8 | LibRaw-devel | 0.19.5-6.el8_10 |
| rapidfort debian 12 | libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 12 | rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 13 | libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort debian 13 | rf-libraw | 0:0.20.2-2.1+deb12u2, 0:0.21.4-2+deb13u1, 0:0.22.1-1 |
| rapidfort fedora 43 | darktable | 5.6.1-2.fc43 |
| rapidfort fedora 43 | darktable-tools-basecurve | 5.6.1-2.fc43 |
| rapidfort fedora 43 | darktable-tools-noise | 5.6.1-2.fc43 |
| rapidfort fedora 43 | mingw-LibRaw | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw32-LibRaw | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw32-LibRaw-static | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw32-LibRaw-tools | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw64-LibRaw | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw64-LibRaw-static | 0.21.5-2.fc43 |
| rapidfort fedora 43 | mingw64-LibRaw-tools | 0.21.5-2.fc43 |
| rapidfort ubuntu 20.04 | libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 20.04 | rf-libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 22.04 | libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 22.04 | rf-libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 24.04 | libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| rapidfort ubuntu 24.04 | rf-libraw | 0:0.21.2-2.1ubuntu0.24.04.2 |
| Red Hat | LibRaw | sin corrección indicada |
| Red Hat | LibRaw-devel | sin corrección indicada |
| Red Hat | LibRaw-static | sin corrección indicada |
| Red Hat | libraw1394 | sin corrección indicada |
| Red Hat | libraw1394-devel | sin corrección indicada |
| rocky 8 | LibRaw | 0.19.5-6.el8_10 |
| root.io debian 13 | libraw | 0.21.4-2.root.io.1 |
| root.io debian 13 | rootio-libraw | 0.21.4-2.root.io.1 |
| ubuntu 18.04-ESM | libraw | sin corrección indicada |
| ubuntu 20.04-ESM | libraw | sin corrección indicada |
| ubuntu 22.04 | libraw | 0.20.2-2ubuntu2.22.04.3 |
| ubuntu 24.04 | libraw | 0.21.2-2.1ubuntu0.24.04.2 |
| ubuntu 26.04 | libraw | 0.21.5b-1ubuntu1.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2026:13284
- https://access.redhat.com/errata/RHSA-2026:15924
- https://access.redhat.com/errata/RHSA-2026:15925
- https://access.redhat.com/errata/RHSA-2026:15926
- https://access.redhat.com/security/cve/CVE-2026-24660
- https://bugzilla.redhat.com/2455926
- https://bugzilla.redhat.com/2455929
- https://bugzilla.redhat.com/2455942
Las 25 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=2455926
- https://bugzilla.redhat.com/show_bug.cgi?id=2455929
- https://bugzilla.redhat.com/show_bug.cgi?id=2455942
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20889
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21413
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24660
- https://errata.almalinux.org/8/ALSA-2026-13284.html
- https://errata.rockylinux.org/RLSA-2026:13284
- https://linux.oracle.com/cve/CVE-2026-24660.html
- https://linux.oracle.com/errata/ELSA-2026-13284.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-24660
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24660.json
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359
- https://ubuntu.com/security/notices/USN-8522-1
- https://www.cve.org/CVERecord?id=CVE-2026-24660
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2359