Loading story…
LibRaw 0.22.1 was released with security fixes for multiple high-severity memory corruption and integer overflow vulnerabilities in the library’s RAW image parsing code, including CVE-2026-21413 in lossless_jpeg_load_raw, CVE-2026-20889 in x3f_thumb_loader, and CVE-2026-20884 in deflate_dng_load_raw. The flaws were reported by Cisco Talos and affect parsing paths for formats such as Canon CR2, Sigma X3F, and DNG files, where crafted metadata or compressed image data can trigger heap-based buffer overflows or undersized allocations followed by out-of-bounds writes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
LibRaw 0.22.1 was released on 2026-04-11 as a bugfix-only update containing multiple security fixes for memory corruption and integer overflow issues in image parsing and decoding code. The release addressed several vulnerabilities reported by Cisco Talos, including flaws in lossless_jpeg_load_raw, x3f_thumb_loader, x3f_load_huffman, HuffTable::initval, uncompressed_fp_dng_load_raw, and deflate_dng_load_raw.
A new LibRaw vulnerability, CVE-2026-21413, was received by Cisco Talos CNA on 2026-04-07. The issue is a heap-based buffer overflow in lossless_jpeg_load_raw that can be triggered by a specially crafted malicious image file, including Canon CR2-related parsing paths.
A new LibRaw vulnerability, CVE-2026-20889, was received by Cisco Talos CNA on 2026-04-07. The flaw is a heap-based buffer overflow in x3f_thumb_loader that can be triggered by a specially crafted Sigma X3F image file.
A new LibRaw vulnerability, CVE-2026-20884, was received by Cisco Talos CNA on 2026-04-07. The issue is an integer overflow in deflate_dng_load_raw that can lead to a heap buffer overflow when parsing a specially crafted malicious file.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-51235** has been disclosed in **LibRaw 0.21**, affecting the `stretch()` function in `src/libraw_cxx.cpp` and the `fuji_rotate()` function in `src/decoders/fuji.cpp`. The flaw is classified as **CWE-122** and described as a buffer overflow that could allow compromise of confidentiality, integrity, and availability. The CVSS v3.1 vector published for the issue is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating remote exploitation is possible with low attack complexity but requires user interaction. The CVE record was updated with **SSVC** metadata stating that proof-of-concept exploitation exists, automation is not currently indicated, and the technical impact is total. Public references tied to the disclosure include the LibRaw project and a GitHub advisory repository, where an update for **CVE-2026-51235** was also posted, signaling active tracking of the issue as defenders assess exposure in applications that process raw image files through the affected library.
Jul 28, 2026
Microsoft and security researchers disclosed **two high-severity libpng vulnerabilities** that can be triggered by processing crafted PNG files, exposing applications and services that rely on the library for image handling. **`CVE-2026-33416`** is a use-after-free bug tied to pointer aliasing in `png_set_tRNS` and `png_set_PLTE`, affecting libpng through version `1.6.55`; the flaw can cause heap corruption and may enable arbitrary code execution, particularly where protections such as ASLR or PIE are absent. Microsoft published guidance for `CVE-2026-33416` through its Security Update Guide. A second issue, **`CVE-2026-33636`**, affects **ARM and AArch64** platforms in Neon-optimized palette expansion code introduced in version `1.6.36`, creating an out-of-bounds read/write condition that can leak sensitive data, corrupt memory, and reliably crash processes. The vulnerabilities affect web applications, embedded devices, and server-side image processing pipelines that parse untrusted PNG content. Maintainers released patched versions **`1.6.56`** and **`1.8.0`**; as a temporary mitigation for the ARM-specific flaw, organizations can rebuild libpng with hardware optimizations disabled.
Jun 29, 2026
OpenEXR patched two high-severity memory corruption vulnerabilities that can be triggered by decoding crafted `.exr` image files. **CVE-2026-34545** affects OpenEXR `3.4.0` through before `3.4.7` and stems from an integer overflow in the HTJ2K decoder when processing an image with a channel width of `32768`, leading to a heap-based buffer overflow with controlled out-of-bounds writes. The flaw could enable remote code execution in applications that open malicious EXR images, particularly where untrusted files are automatically parsed. A second flaw, **CVE-2026-34544**, affects OpenEXR `3.4.0` through before `3.4.8` and allows an out-of-bounds write in `uncompress_b44_impl()` during `exr_decoding_run()` when handling crafted B44 or B44A-compressed EXR files. Depending on heap layout, the issue can cause immediate crashes or corrupt adjacent allocations, with the CVE classified under `CWE-787` and `CWE-190`. Organizations using OpenEXR in media pipelines, rendering tools, or image-processing applications should upgrade to **OpenEXR 3.4.8** to address both issues.
Jun 29, 2026