Medium severity · published Apr 2, 2026
CVE-2026-5318
LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibRaw · Libraw
0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +16 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5318
Product
https://github.com/LibRaw/LibRaw/
Patch
https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995
Issue Tracking
https://github.com/LibRaw/LibRaw/issues/794
Issue Tracking
https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499
Product
https://github.com/LibRaw/LibRaw/releases/tag/0.22.1
Exploit
https://github.com/biniamf/pocs/tree/main/libraw_lljpeg
More from LibRaw
9.8
CVE-2026-20911
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b
9.8
CVE-2026-21413
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b
9.8
CVE-2026-20889
A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b
9.8
CVE-2026-24450
An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2
9.8
CVE-2026-20884
An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2