CVE-2026-5318

Medium CVSS: 5.3

A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.

Vendor

Product

CWE

CWE-119

Yayın Tarihi

2026-04-02 03:16:07

Güncelleme

2026-04-07 12:16:21

Source Identifier

cna@vuldb.com

KEV Date Added

Kategoriler

CWE-119 MEDIUM 2026

Referanslar

https://github.com/LibRaw/LibRaw/ https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995 https://github.com/LibRaw/LibRaw/issues/794 https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499 https://github.com/LibRaw/LibRaw/releases/tag/0.22.1 https://github.com/biniamf/pocs/tree/main/libraw_lljpeg https://vuldb.com/submit/780538 https://vuldb.com/vuln/354650 https://vuldb.com/vuln/354650/cti