PT-2026-30829 · Libraw · Libraw

Francesco Benvenuto · Publicado 2026-04-07 · Atualizado 2026-04-22 · CVE-2026-20884

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibRaw versões anteriores ao Commit 8dc68e2

Description Um estouro de inteiro existe na funcionalidade deflate dng load raw do LibRaw. Um arquivo malicioso especialmente criado pode levar a um estouro de buffer heap. Um atacante pode fornecer um arquivo malicioso para acionar este problema.

Recommendations Atualize o LibRaw para a versão Commit 8dc68e2 ou posterior.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2026-20884

ECHO-E74F-830C-CD04

OPENSUSE-SU-2026:10565-1

OPENSUSE-SU-2026:20574-1

SUSE-SU-2026:1555-1

SUSE-SU-2026:1556-1

Produtos afetados

Libraw

Referências · 30

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364 · Exploit
• https://github.com/LibRaw/LibRaw/commit/39873163faa29ed5dfc3bb5aab1b46ed807b210f · Nota
• https://cve.org/CVERecord?id=CVE-2026-20884 · Nota de Segurança
• https://bugzilla.suse.com/1261675 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-20884 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-20911 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261556-1 · Nota
• https://suse.com/security/cve/CVE-2026-5342 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261555-1 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2026:20574-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-20889 · Nota
• https://ubuntu.com/security/CVE-2026-20884 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:1556-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1261674 · Nota
• https://suse.com/security/cve/CVE-2026-21413 · Nota