A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
References
| Link | Resource |
|---|---|
| https://github.com/LibRaw/LibRaw/ | Product |
| https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995 | Patch |
| https://github.com/LibRaw/LibRaw/issues/794 | Issue Tracking |
| https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499 | Issue Tracking |
| https://github.com/LibRaw/LibRaw/releases/tag/0.22.1 | Product Release Notes |
| https://github.com/biniamf/pocs/tree/main/libraw_lljpeg | Exploit Third Party Advisory |
| https://vuldb.com/submit/780538 | Exploit Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/354650 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/354650/cti | Permissions Required VDB Entry |
Configurations
History
29 Apr 2026, 21:53
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Libraw
Libraw libraw |
|
| CPE | cpe:2.3:a:libraw:libraw:*:*:*:*:*:*:*:* | |
| References | () https://github.com/LibRaw/LibRaw/ - Product | |
| References | () https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995 - Patch | |
| References | () https://github.com/LibRaw/LibRaw/issues/794 - Issue Tracking | |
| References | () https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499 - Issue Tracking | |
| References | () https://github.com/LibRaw/LibRaw/releases/tag/0.22.1 - Product, Release Notes | |
| References | () https://github.com/biniamf/pocs/tree/main/libraw_lljpeg - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/submit/780538 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/354650 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/354650/cti - Permissions Required, VDB Entry |
07 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Apr 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 03:16
Updated : 2026-04-29 21:53
NVD link : CVE-2026-5318
Mitre link : CVE-2026-5318
CVE.ORG link : CVE-2026-5318
JSON object : View
Products Affected
libraw
- libraw