CVE-2026-21413

The vulnerability results from improper input data validation (CWE-129 — improper validation of array index) during the loading of lossless JPEG data in the lossless_jpeg_load_raw function. An attacker provides a specially crafted file that causes a heap buffer overflow. No authentication or user interaction beyond opening the file is required — the attack vector is network-based, without the need for special privileges.

Successful exploitation of the vulnerability can lead to arbitrary code execution in the context of the file processing process (RCE), as well as violations of system confidentiality, integrity, and availability. An attacker can gain full control over the vulnerable application.

Patches available from the vendor should be applied according to the references. It is recommended to update LibRaw to a version containing the fix described in the Cisco Talos report TALOS-2026-2331. Until the patch is applied, it is advisable to restrict processing of untrusted RAW files and isolate applications using the LibRaw library.

LibRaw commit 0b56545 and commit d20315b — versions indicated in vendor references