Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-24450: LibRaw: Malicious DNG File Can Cause System Crashes
CVE-2026-24450 · published 5 months ago
Summary
A bug in LibRaw can be exploited by an attacker who provides a specially crafted DNG file, causing the system to run out of memory and potentially leading to a crash. This can be particularly concerning if the system is used for important tasks or handles sensitive data. To protect against this, it's essential to keep LibRaw up to date with the latest patches.
What to do
- Update debian rootio-libraw to version 0.21.4-2.root.io.3.
- Update debian rootio-libraw to version 0.21.4-2.root.io.2.
- Update debian libraw to version 0.21.4-2.root.io.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:18.04:LTS | canonical | ufraw | All versions |
| Ubuntu:20.04:LTS | canonical | darktable | All versions |
| Ubuntu:20.04:LTS | canonical | dcraw | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | digikam | All versions |
| Ubuntu:20.04:LTS | canonical | exactimage | All versions |
| Ubuntu:20.04:LTS | canonical | kodi | All versions |
| Ubuntu:20.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:22.04:LTS | canonical | darktable | All versions |
| Ubuntu:22.04:LTS | canonical | dcraw | All versions |
| Ubuntu:22.04:LTS | canonical | exactimage | All versions |
| Ubuntu:22.04:LTS | canonical | kodi | All versions |
| Ubuntu:22.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | digikam | All versions |
| Ubuntu:24.04:LTS | canonical | darktable | All versions |
| Ubuntu:24.04:LTS | canonical | dcraw | All versions |
| Ubuntu:24.04:LTS | canonical | digikam | All versions |
| Ubuntu:24.04:LTS | canonical | exactimage | All versions |
| Ubuntu:24.04:LTS | canonical | kodi | All versions |
| Ubuntu:24.04:LTS | canonical | libraw | All versions |
| Ubuntu:24.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:25.10 | canonical | darktable | All versions |
| Ubuntu:25.10 | canonical | dcraw | All versions |
| Ubuntu:25.10 | canonical | digikam | All versions |
| Ubuntu:25.10 | canonical | exactimage | All versions |
| Ubuntu:25.10 | canonical | kodi | All versions |
| Ubuntu:25.10 | canonical | libraw | All versions |
| Ubuntu:25.10 | canonical | rawtherapee | All versions |
| Ubuntu:26.04:LTS | canonical | darktable | All versions |
| Ubuntu:26.04:LTS | canonical | dcraw | All versions |
| Ubuntu:26.04:LTS | canonical | digikam | All versions |
| Ubuntu:26.04:LTS | canonical | exactimage | All versions |
| Ubuntu:26.04:LTS | canonical | kodi | All versions |
| Ubuntu:26.04:LTS | canonical | libraw | All versions |
| Ubuntu:26.04:LTS | canonical | rawtherapee | All versions |
| Debian:14 | debian | libraw | All versions |
| Debian:11 | debian | libraw | All versions |
| Debian:12 | debian | libraw | All versions |
| Debian:13 | debian | libraw | All versions |
| – | libraw | libraw |
0.22.1 cpe:2.3:a:libraw:libraw:0.22.1:*:*:*:*:*:*:* |
| Root:Debian:13 | debian | rootio-libraw |
< 0.21.4-2.root.io.3 < 0.21.4-2.root.io.2 Fix: upgrade to 0.21.4-2.root.io.3
|
| Ubuntu:16.04:LTS | canonical | darktable | All versions |
| Ubuntu:16.04:LTS | canonical | dcraw | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | digikam | All versions |
| Ubuntu:16.04:LTS | canonical | exactimage | All versions |
| Ubuntu:16.04:LTS | canonical | kodi | All versions |
| Ubuntu:16.04:LTS | canonical | rawtherapee | All versions |
| Ubuntu:16.04:LTS | canonical | ufraw | All versions |
| Ubuntu:18.04:LTS | canonical | darktable | All versions |
| Ubuntu:18.04:LTS | canonical | dcraw | All versions |
Showing 50 of 54. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | digikam | All versions |
| Ubuntu:18.04:LTS | canonical | exactimage | All versions |
| Ubuntu:18.04:LTS | canonical | kodi | All versions |
| Root:Debian:13 | debian | libraw |
< 0.21.4-2.root.io.3 Fix: upgrade to 0.21.4-2.root.io.3
|
Original advisory text
An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attack...
An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363
- https://security-tracker.debian.org/tracker/CVE-2026-24450 Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2363 Exploit Third Party Advisory
- https://ubuntu.com/security/CVE-2026-24450 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-24450 Third Party Advisory
Severity
9.8
Critical
CVSS 3.1: 8.1 (NVD)
CVSS 3.1: 8.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-190Integer Overflow
Timeline
Published7 Apr 2026
Updated25 Sep 2026
First seen7 Apr 2026
Track software like this
Free during beta