PT-2026-29677 · Libraw · Libraw

Biniam · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-5318

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions LibRaw versions up to 0.22.0

Description A weakness exists in LibRaw, specifically in the HuffTable::initval function within the src/decompressors/losslessjpeg.cpp file of the JPEG DHT Parser component. This allows for an out-of-bounds write due to manipulation of the bits[] argument. The attack can be initiated remotely and an exploit is publicly available.

Recommendations Upgrade to version 0.22.1 or later to address this issue.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

CVE-2026-5318

ECHO-DDB8-C818-EDCA

Affected Products

Libraw

References · 18

• 🔥 https://vuldb.com/submit/780538 · Exploit
• 🔥 https://github.com/biniamf/pocs/tree/main/libraw_lljpeg · Exploit
• https://github.com/LibRaw/LibRaw/releases/tag/0.22.1 · Patch
• https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5318 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5318 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5318 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5318 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5318 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5318 · Vendor Advisory
• https://github.com/LibRaw/LibRaw/issues/794 · Note
• https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499 · Note
• https://twitter.com/cyberbivash/status/2039573983398445261 · Twitter Post
• https://vuldb.com/vuln/354650 · Note
• https://vuldb.com/vuln/354650/cti · Note