A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4704 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4704-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 29, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libraw     Version        : 0.20.2-1+deb11u3 0.20.2-2.1+deb12u2     CVE ID         : CVE-2026-5342 CVE-2026-20884 CVE-2026-20889 CVE-2026-21413                      CVE-2026-24660     Debian Bug     : 1132655 1133845

    Multiple vulnerabilities were found in libraw, a raw image decoder     library, which could lead to application crash, information disclosure     or data corruption.

    CVE-2026-5342

        Biniam F. Demissie discovered an out-of-bounds read in the decoder         routine for RAW image files from Nikon digital cameras.

    CVE-2026-20884

        Francesco Benvenuto discovered an integer overflow vulnerability         in the decoder routine for deflate-compressed floating-point DNG         RAW files, which may lead to heap buffer overflow via specially         crafted input file.

    CVE-2026-20889

        Francesco Benvenuto discovered a heap-based buffer overflow         vulnerability in the thumbnail extraction routine for RAW image         files from Sigma/Foveon X3F digital cameras.

    CVE-2026-21413

        Francesco Benvenuto discovered a heap-based buffer overflow         vulnerability in the lossless JPEG decoder used for processing         compressed RAW data from various camera formats.

    CVE-2026-24660

        Francesco Benvenuto discovered a heap-based buffer overflow         vulnerability in the Huffman decompression routine for RAW image         files from Sigma/Foveon X3F digital cameras.

    For Debian 11 bullseye, these problems have been fixed in version     0.20.2-1+deb11u3.

    For Debian 12 bookworm, these problems have been fixed in version     0.20.2-2.1+deb12u2.

    We recommend that you upgrade your libraw packages.

    For the detailed security status of libraw please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libraw

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8522-1 advisory.

    It was discovered that LibRaw incorrectly handled certain Nikon RAW image files. An attacker could     possibly use this issue to cause LibRaw to crash, resulting in a denial of service. (CVE-2026-5342)

    It was discovered that LibRaw had an integer overflow in its DNG image loader. An attacker could possibly     use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-20884)

    It was discovered that LibRaw incorrectly handled certain X3F thumbnail data. An attacker could possibly     use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-20889)

    It was discovered that LibRaw had a heap-based buffer overflow in its lossless JPEG image loader. An     attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or     execute arbitrary code. (CVE-2026-21413)

    It was discovered that LibRaw had an integer overflow in its uncompressed floating-point DNG image loader.
    An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or     execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2026-24450)

    It was discovered that LibRaw had a heap-based buffer overflow in its X3F Huffman decoder. An attacker     could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute     arbitrary code. (CVE-2026-24660)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a436c41faf advisory.

    Update to libraw-0.22.1.

    ----

    Backport fixes for CVE-2026-5318 and CVE-2026-5342.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1556-1 advisory.

    - CVE-2026-5342: out-of-bounds read via `LibRaw::nikon_load_padded_packed_raw` (bsc#1261499).
    - CVE-2026-20884: integer overflow and heap buffer overflow via `deflate_dng_load_raw` (bsc#1261671).
    - CVE-2026-20889: heap-based buffer overflow in `x3f_thumb_loader`(bsc#1261672).
    - CVE-2026-20911: heap-based buffer overflow in `HuffTable::initval`(bsc#1261673).
    - CVE-2026-21413: heap-based buffer overflow in `lossless_jpeg_load_raw` (bsc#1261674).
    - CVE-2026-24660: heap-based buffer overflow in `x3f_load_huffman` (bsc#1261676).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1555-1 advisory.

    - CVE-2026-5342: out-of-bounds read via `LibRaw::nikon_load_padded_packed_raw` (bsc#1261499).
    - CVE-2026-20884: integer overflow and heap buffer overflow via `deflate_dng_load_raw` (bsc#1261671).
    - CVE-2026-20889: heap-based buffer overflow in `x3f_thumb_loader`(bsc#1261672).
    - CVE-2026-20911: heap-based buffer overflow in `HuffTable::initval`(bsc#1261673).
    - CVE-2026-21413: heap-based buffer overflow in `lossless_jpeg_load_raw` (bsc#1261674).
    - CVE-2026-24450: integer overflow and heap buffer overflow via `uncompressed_fp_dng_load_raw`     (bsc#1261675).
    - CVE-2026-24660: heap-based buffer overflow in `x3f_load_huffman` (bsc#1261676).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20574-1 advisory.

    - CVE-2026-5342: crafted TIFF/NEF file can cause an out-of-bounds read (bsc#1261499).
    - CVE-2026-20884: integer overflow vulnerability in the deflate_dng_load_raw (bsc#1261671).
    - CVE-2026-20889: heap-based buffer overflow vulnerability in the x3f_thumb_loader (bsc#1261672).
    - CVE-2026-20911: heap-based buffer overflow vulnerability in the HuffTable: initval (bsc#1261673).
    - CVE-2026-21413: heap-based buffer overflow vulnerability in the lossless_jpeg_load_raw (bsc#1261674).
    - CVE-2026-24450: integer overflow vulnerability in uncompressed_fp_dng_load_raw (bsc#1261675).
    - CVE-2026-24660: heap-based buffer overflow vulnerability in the x3f_load_huffman (bsc#1261676).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-bef0050737 advisory.

    LibRaw 0.22.1 and rebuilds

    ----

    Release 3.1.12.0 (Apr 1, 2026) -- compared to 3.1.11.0

    oiiotool: Better type understanding with -i:ch= and other cleanup #5056     texture: Fix texture overblur with st-blur parameters #5071 #5080 (by Pascal Lecocq) (3.1.12.0, 3.0.17.0)     IBA: Handle offset data windows in fillholes_pushpull #5105 (3.1.12.0, 3.0.17.0)     ImageInput: check_open fixes and new validity checks #5087 (3.1.12.0, 3.0.17.0)     bmp: Use check_open to guard against corrupt resolutions #5086 (3.1.12.0, 3.0.17.0)     heif: Fix invalid read writing 8-bit images with dimensions not a multiple of 64 #5095 (by Brecht Van     Lommel)     ico: Various validity checks and error handling for corruptions #5088 (3.1.12.0, 3.0.17.0)     jpeg: Improved safety and error reporting for jpeg and iptc #5081     jpeg2000: Suppress leak when reading with OpenJPH #5098     psd: Fixes against corrupt files with better validation #5089 (3.1.12.0, 3.0.17.0)     rla: Lots of additional validity checking and safety #5094 (3.1.12.0, 3.0.17.0)     tiff: Support GPS fields, and other metadata enhancements #5050     tiff: Fix buffer overrun and improve error reporting #5082, fix wrong number of values passed to     invert_photometric #5083, check for invalid bit depth in palette images #5091     ImageSpec: metadata_val improved safety #5096 (3.1.12.0, 3.0.17.0)     fix: Fix UB-sanitizer warning about alignment #5097     fix: Catch exceptions in print-uncaught-messages destructor #5103     fix: Enhanced exception safety for our use of OpenColorIO #5114     fix: Fix possible fmt exceptions where we might have passed null string #5115     build: Test building with clang 22.1, fix warnings uncovered #5067     build: Improve security by pinning auto-build dependencies by hash #5076     build: Include idiff in the python wheels we build #5104 (3.1.12.0, 3.0.17.0)     build(pybind11): Address new pybind11 float/int auto-conversion behavior #5058     build(win): Embed manifest in OIIO executables to enable long path handling #5066 (by Nathan Rusch)     ci: Add CI test for MSVS 2026 #5060 (3.1.12.0, 3.0.17.0)     ci: For security, replace workflow substitutions with safer env substitutions #5070     ci: Speed up slow benchmarks for debug and sanitizer CI tests #5077     ci: On Mac Intel CI variant, don't install openvdb, for speed #5065 (3.1.12.0, 3.0.17.0)     ci: Bump GitHub Actions to latest versions #5078 #5110 #5119     ci: Fix broken Mac CI and wheel building by specifying full compiler paths #5100 #5101 (3.1.12.0,     3.0.17.0)     ci: Update certificates to be able to install icc #5122 (3.1.12.0, 3.0.17.0)     ci: Turn off nightly workflows for user forks #5042     tests: New ref outputs for tiff-misc, heif no-avif, and ffmpeg 8.1 cases #5075 #5079 #5099 #5112     docs: Update description for dwaCompressionLevel #5074 (by Aamir Raza)     docs: Fix formatting examples for version macros #5073     docs: Keep TextureSystem docs in sync with ImageCache #5085 (3.1.12.0, 3.0.17.0)     docs: Fix typos and incorrect attribute name in a comment #5093 (3.1.12.0, 3.0.17.0)     docs: Fix misstatement about oiiotool --if #5102 (3.1.12.0, 3.0.17.0)     admin: Draft policy on use of AI coding assistants #5072 (3.1.12.0, 3.0.17.0)     ci: Freetype adjustments #4999

    ----

    Update to 5.1 (#2451401)

    ----

    Update to 5.0 (#2447841)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-ffba395f42 advisory.

    LibRaw 0.22.1 and rebuilds.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw has been found in LibRaw up to 0.22.0. This affects the function     LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component     TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It     is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to     version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is     advisable to upgrade the affected component. (CVE-2026-5342)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
330523	Debian dla-4704 : libraw-bin - security update	Nessus	Debian Local Security Checks	Local	medium
326248	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : LibRaw vulnerabilities (USN-8522-1)	Nessus	Ubuntu Local Security Checks	Local	medium
310541	Fedora 44 : mingw-LibRaw (2026-a436c41faf)	Nessus	Fedora Local Security Checks	Local	medium
310063	SUSE SLES15 Security Update : libraw (SUSE-SU-2026:1556-1)	Nessus	SuSE Local Security Checks	Local	medium
310058	SUSE SLED15 / SLES15 Security Update : libraw (SUSE-SU-2026:1555-1)	Nessus	SuSE Local Security Checks	Local	medium
309150	openSUSE 16 Security Update : libraw (openSUSE-SU-2026:20574-1)	Nessus	SuSE Local Security Checks	Local	medium
306255	Fedora 44 : ImageMagick / LibRaw / OpenImageIO / OpenImageIO2.5 / etc (2026-bef0050737)	Nessus	Fedora Local Security Checks	Local	medium
305678	Fedora 45 : ImageMagick / LibRaw / OpenImageIO / OpenImageIO2.5 / etc (2026-ffba395f42)	Nessus	Fedora Local Security Checks	Local	medium
304755	Linux Distros Unpatched Vulnerability : CVE-2026-5342	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-5342

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium