CVE-2026-20889

CriticalCVSS 9.8

Published: 07/04/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

47th percentile - higher than 47% of all known CVEs

Summary

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader function of LibRaw (commit d20315b). A specially crafted malicious file can lead to a heap buffer overflow.

Risk Assessment

An attacker can provide a malicious file that, when processed by an application using LibRaw, may lead to arbitrary code execution or system crash.

Recommendation

Update LibRaw to the latest patched version. Until updated, avoid processing untrusted RAW files.

Original NVD description (English source)

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.