PT-2026-30833 · Libraw+1 · Libraw+1

Francesco Benvenuto · Publicado 2026-04-07 · Atualizado 2026-05-19 · CVE-2026-24450

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibRaw versões anteriores ao Commit 8dc68e2

Description Um estouro de inteiro existe na funcionalidade uncompressed fp dng load raw do LibRaw. Um arquivo malicioso especialmente criado pode acionar um estouro de buffer heap. Um atacante pode fornecer um arquivo malicioso para explorar essa falha.

Recommendations Atualize o LibRaw para o Commit 8dc68e2 ou posterior.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALSA-2026:11360

ALSA-2026:19345

CVE-2026-24450

ECHO-8D16-7D9A-2E99

OPENSUSE-SU-2026:10565-1

OPENSUSE-SU-2026:20574-1

RHSA-2026:11360

RHSA-2026:13854

RHSA-2026:13870

SUSE-SU-2026:1555-1

Produtos afetados

Libraw

Rocky Linux

Referências · 41

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363 · Exploit
• https://github.com/LibRaw/LibRaw/commit/a58727c1a3cfef4101700e546a6a661c6a299d97 · Nota
• https://errata.almalinux.org/9/ALSA-2026-19345.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-24450 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261555-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-24450 · Nota de Segurança
• https://errata.rockylinux.org/RLSA-2026:11360 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24450 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-5342 · Nota
• https://bugzilla.suse.com/1261676 · Nota
• https://suse.com/security/cve/CVE-2026-20911 · Nota
• https://osv.dev/vulnerability/ALSA-2026:11360 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-24450 · Nota
• https://bugzilla.suse.com/1261672 · Nota
• https://access.redhat.com/errata/RHSA-2026:19345 · Nota