ALAS2-2026-3255: CVEs fixed (Amazon Linux)

ALAS2-2026-3255 fixes 2 tracked CVEs. Affected systems and fixed versions.

• CVE-2026-21413 CRITICAL 9.8 DOWNGRADE A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit
• CVE-2026-20889 CRITICAL 9.8 DOWNGRADE A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d2031

Applies to

• Amazon Linux 2

← Back to latest CVEs