CVE-2026-5318

LOW EPSS 45.6%
Published Apr 2, 20262mo ago · Modified Jun 17, 20261w ago
2.1 CVSS 4.0
Low
Find Similar
Published Apr 2, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.

CVSS Details

Base Score
2.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
45.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
librawlibraw* <0.22.1

References 9

  • github.com https://github.com/LibRaw/LibRaw/
    Product
  • github.com https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995
    Patch
  • github.com https://github.com/LibRaw/LibRaw/issues/794
    Issue Tracking
  • github.com https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499
    Issue Tracking
  • github.com https://github.com/LibRaw/LibRaw/releases/tag/0.22.1
    ProductRelease Notes
  • github.com https://github.com/biniamf/pocs/tree/main/libraw_lljpeg
    ExploitThird Party Advisory
  • vuldb.com https://vuldb.com/submit/780538
    ExploitThird Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/vuln/354650
    Third Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/vuln/354650/cti
    Permissions RequiredVDB Entry

Remediation

  • github.com https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995
    Patch