PatchTheCVElibraw vulnerabilities and fixes
Recent CVEs affecting libraw, with upgrade or downgrade steps. 8 tracked.
libraw has 8 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-04-07. Highest priority: CVE-2026-21413 (score 62/100).
- CVE-2026-21413 CRITICAL 9.8 DOWNGRADE A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit
- CVE-2026-5342 MEDIUM 5.3 UPGRADE A flaw has been found in LibRaw up to 0.22.0
- CVE-2026-24660 HIGH 8.1 DOWNGRADE A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d2031
- CVE-2026-20911 CRITICAL 9.8 DOWNGRADE A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b5
- CVE-2026-20889 CRITICAL 9.8 DOWNGRADE A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d2031
- CVE-2026-5318 MEDIUM 4.3 UPGRADE A weakness has been identified in LibRaw up to 0.22.0
- CVE-2026-24450 HIGH 8.1 DOWNGRADE An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8d
- CVE-2026-20884 HIGH 8.1 DOWNGRADE An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2
FAQ
How do I fix libraw vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libraw being exploited right now?
None of the tracked libraw CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libraw CVE should I patch first?
CVE-2026-21413 currently ranks highest (62/100): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit.