CVE-2026-5318

Katalog CVE

CVSS 4.3 · Medium EPSS 0,78%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada libraw. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995 patch
• https://github.com/biniamf/pocs/tree/main/libraw_lljpeg exploit · advisory pihak ketiga
• https://vuldb.com/submit/780538 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/354650 advisory pihak ketiga · vdb entry
• https://github.com/LibRaw/LibRaw/ product
• https://github.com/LibRaw/LibRaw/issues/794 issue tracking
• https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499 issue tracking
• https://github.com/LibRaw/LibRaw/releases/tag/0.22.1 product · release notes
• https://vuldb.com/vuln/354650/cti permissions required · vdb entry