OPENSUSE-SU-2026:20574-1
Vulnerability from csaf_opensuse - Published: 2026-04-20 15:30 - Updated: 2026-04-20 15:30Summary
Security update for libraw
Severity
Important
Notes
Title of the patch: Security update for libraw
Description of the patch: This update for libraw fixes the following issues:
- CVE-2026-5342: crafted TIFF/NEF file can cause an out-of-bounds read (bsc#1261499).
- CVE-2026-20884: integer overflow vulnerability in the deflate_dng_load_raw (bsc#1261671).
- CVE-2026-20889: heap-based buffer overflow vulnerability in the x3f_thumb_loader (bsc#1261672).
- CVE-2026-20911: heap-based buffer overflow vulnerability in the HuffTable: initval (bsc#1261673).
- CVE-2026-21413: heap-based buffer overflow vulnerability in the lossless_jpeg_load_raw (bsc#1261674).
- CVE-2026-24450: integer overflow vulnerability in uncompressed_fp_dng_load_raw (bsc#1261675).
- CVE-2026-24660: heap-based buffer overflow vulnerability in the x3f_load_huffman (bsc#1261676).
Patchnames: openSUSE-Leap-16.0-599
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libraw",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libraw fixes the following issues:\n\n- CVE-2026-5342: crafted TIFF/NEF file can cause an out-of-bounds read (bsc#1261499).\n- CVE-2026-20884: integer overflow vulnerability in the deflate_dng_load_raw (bsc#1261671).\n- CVE-2026-20889: heap-based buffer overflow vulnerability in the x3f_thumb_loader (bsc#1261672).\n- CVE-2026-20911: heap-based buffer overflow vulnerability in the HuffTable: initval (bsc#1261673).\n- CVE-2026-21413: heap-based buffer overflow vulnerability in the lossless_jpeg_load_raw (bsc#1261674).\n- CVE-2026-24450: integer overflow vulnerability in uncompressed_fp_dng_load_raw (bsc#1261675).\n- CVE-2026-24660: heap-based buffer overflow vulnerability in the x3f_load_huffman (bsc#1261676).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-599",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20574-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1261499",
"url": "https://bugzilla.suse.com/1261499"
},
{
"category": "self",
"summary": "SUSE Bug 1261671",
"url": "https://bugzilla.suse.com/1261671"
},
{
"category": "self",
"summary": "SUSE Bug 1261672",
"url": "https://bugzilla.suse.com/1261672"
},
{
"category": "self",
"summary": "SUSE Bug 1261673",
"url": "https://bugzilla.suse.com/1261673"
},
{
"category": "self",
"summary": "SUSE Bug 1261674",
"url": "https://bugzilla.suse.com/1261674"
},
{
"category": "self",
"summary": "SUSE Bug 1261675",
"url": "https://bugzilla.suse.com/1261675"
},
{
"category": "self",
"summary": "SUSE Bug 1261676",
"url": "https://bugzilla.suse.com/1261676"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-20884 page",
"url": "https://www.suse.com/security/cve/CVE-2026-20884/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-20889 page",
"url": "https://www.suse.com/security/cve/CVE-2026-20889/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-20911 page",
"url": "https://www.suse.com/security/cve/CVE-2026-20911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-21413 page",
"url": "https://www.suse.com/security/cve/CVE-2026-21413/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-24450 page",
"url": "https://www.suse.com/security/cve/CVE-2026-24450/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-24660 page",
"url": "https://www.suse.com/security/cve/CVE-2026-24660/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5342 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5342/"
}
],
"title": "Security update for libraw",
"tracking": {
"current_release_date": "2026-04-20T15:30:10Z",
"generator": {
"date": "2026-04-20T15:30:10Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:20574-1",
"initial_release_date": "2026-04-20T15:30:10Z",
"revision_history": [
{
"date": "2026-04-20T15:30:10Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libraw-devel-0.21.4-160000.3.1.aarch64",
"product": {
"name": "libraw-devel-0.21.4-160000.3.1.aarch64",
"product_id": "libraw-devel-0.21.4-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libraw-devel-static-0.21.4-160000.3.1.aarch64",
"product": {
"name": "libraw-devel-static-0.21.4-160000.3.1.aarch64",
"product_id": "libraw-devel-static-0.21.4-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libraw-tools-0.21.4-160000.3.1.aarch64",
"product": {
"name": "libraw-tools-0.21.4-160000.3.1.aarch64",
"product_id": "libraw-tools-0.21.4-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libraw23-0.21.4-160000.3.1.aarch64",
"product": {
"name": "libraw23-0.21.4-160000.3.1.aarch64",
"product_id": "libraw23-0.21.4-160000.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libraw-devel-0.21.4-160000.3.1.ppc64le",
"product": {
"name": "libraw-devel-0.21.4-160000.3.1.ppc64le",
"product_id": "libraw-devel-0.21.4-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"product": {
"name": "libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"product_id": "libraw-devel-static-0.21.4-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libraw-tools-0.21.4-160000.3.1.ppc64le",
"product": {
"name": "libraw-tools-0.21.4-160000.3.1.ppc64le",
"product_id": "libraw-tools-0.21.4-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libraw23-0.21.4-160000.3.1.ppc64le",
"product": {
"name": "libraw23-0.21.4-160000.3.1.ppc64le",
"product_id": "libraw23-0.21.4-160000.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libraw-devel-0.21.4-160000.3.1.s390x",
"product": {
"name": "libraw-devel-0.21.4-160000.3.1.s390x",
"product_id": "libraw-devel-0.21.4-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libraw-devel-static-0.21.4-160000.3.1.s390x",
"product": {
"name": "libraw-devel-static-0.21.4-160000.3.1.s390x",
"product_id": "libraw-devel-static-0.21.4-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libraw-tools-0.21.4-160000.3.1.s390x",
"product": {
"name": "libraw-tools-0.21.4-160000.3.1.s390x",
"product_id": "libraw-tools-0.21.4-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libraw23-0.21.4-160000.3.1.s390x",
"product": {
"name": "libraw23-0.21.4-160000.3.1.s390x",
"product_id": "libraw23-0.21.4-160000.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libraw-devel-0.21.4-160000.3.1.x86_64",
"product": {
"name": "libraw-devel-0.21.4-160000.3.1.x86_64",
"product_id": "libraw-devel-0.21.4-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libraw-devel-static-0.21.4-160000.3.1.x86_64",
"product": {
"name": "libraw-devel-static-0.21.4-160000.3.1.x86_64",
"product_id": "libraw-devel-static-0.21.4-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libraw-tools-0.21.4-160000.3.1.x86_64",
"product": {
"name": "libraw-tools-0.21.4-160000.3.1.x86_64",
"product_id": "libraw-tools-0.21.4-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libraw23-0.21.4-160000.3.1.x86_64",
"product": {
"name": "libraw23-0.21.4-160000.3.1.x86_64",
"product_id": "libraw23-0.21.4-160000.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-0.21.4-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64"
},
"product_reference": "libraw-devel-0.21.4-160000.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-0.21.4-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le"
},
"product_reference": "libraw-devel-0.21.4-160000.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-0.21.4-160000.3.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x"
},
"product_reference": "libraw-devel-0.21.4-160000.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-0.21.4-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64"
},
"product_reference": "libraw-devel-0.21.4-160000.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-static-0.21.4-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64"
},
"product_reference": "libraw-devel-static-0.21.4-160000.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-static-0.21.4-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le"
},
"product_reference": "libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-static-0.21.4-160000.3.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x"
},
"product_reference": "libraw-devel-static-0.21.4-160000.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-devel-static-0.21.4-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64"
},
"product_reference": "libraw-devel-static-0.21.4-160000.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-tools-0.21.4-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64"
},
"product_reference": "libraw-tools-0.21.4-160000.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-tools-0.21.4-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le"
},
"product_reference": "libraw-tools-0.21.4-160000.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-tools-0.21.4-160000.3.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x"
},
"product_reference": "libraw-tools-0.21.4-160000.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw-tools-0.21.4-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64"
},
"product_reference": "libraw-tools-0.21.4-160000.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw23-0.21.4-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64"
},
"product_reference": "libraw23-0.21.4-160000.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw23-0.21.4-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le"
},
"product_reference": "libraw23-0.21.4-160000.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw23-0.21.4-160000.3.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x"
},
"product_reference": "libraw23-0.21.4-160000.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libraw23-0.21.4-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
},
"product_reference": "libraw23-0.21.4-160000.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-20884",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-20884"
}
],
"notes": [
{
"category": "general",
"text": "An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-20884",
"url": "https://www.suse.com/security/cve/CVE-2026-20884"
},
{
"category": "external",
"summary": "SUSE Bug 1261671 for CVE-2026-20884",
"url": "https://bugzilla.suse.com/1261671"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "important"
}
],
"title": "CVE-2026-20884"
},
{
"cve": "CVE-2026-20889",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-20889"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-20889",
"url": "https://www.suse.com/security/cve/CVE-2026-20889"
},
{
"category": "external",
"summary": "SUSE Bug 1261672 for CVE-2026-20889",
"url": "https://bugzilla.suse.com/1261672"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "important"
}
],
"title": "CVE-2026-20889"
},
{
"cve": "CVE-2026-20911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-20911"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-20911",
"url": "https://www.suse.com/security/cve/CVE-2026-20911"
},
{
"category": "external",
"summary": "SUSE Bug 1261673 for CVE-2026-20911",
"url": "https://bugzilla.suse.com/1261673"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "important"
}
],
"title": "CVE-2026-20911"
},
{
"cve": "CVE-2026-21413",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-21413"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-21413",
"url": "https://www.suse.com/security/cve/CVE-2026-21413"
},
{
"category": "external",
"summary": "SUSE Bug 1261674 for CVE-2026-21413",
"url": "https://bugzilla.suse.com/1261674"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "important"
}
],
"title": "CVE-2026-21413"
},
{
"cve": "CVE-2026-24450",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-24450"
}
],
"notes": [
{
"category": "general",
"text": "An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-24450",
"url": "https://www.suse.com/security/cve/CVE-2026-24450"
},
{
"category": "external",
"summary": "SUSE Bug 1261675 for CVE-2026-24450",
"url": "https://bugzilla.suse.com/1261675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "important"
}
],
"title": "CVE-2026-24450"
},
{
"cve": "CVE-2026-24660",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-24660"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-24660",
"url": "https://www.suse.com/security/cve/CVE-2026-24660"
},
{
"category": "external",
"summary": "SUSE Bug 1261676 for CVE-2026-24660",
"url": "https://bugzilla.suse.com/1261676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "important"
}
],
"title": "CVE-2026-24660"
},
{
"cve": "CVE-2026-5342",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5342"
}
],
"notes": [
{
"category": "general",
"text": "A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5342",
"url": "https://www.suse.com/security/cve/CVE-2026-5342"
},
{
"category": "external",
"summary": "SUSE Bug 1261499 for CVE-2026-5342",
"url": "https://bugzilla.suse.com/1261499"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-devel-static-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw-tools-0.21.4-160000.3.1.x86_64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.aarch64",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.ppc64le",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.s390x",
"openSUSE Leap 16.0:libraw23-0.21.4-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-20T15:30:10Z",
"details": "low"
}
],
"title": "CVE-2026-5342"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…