CVE-2026-24450

A flaw was found in LibRaw. A remote attacker could exploit an integer overflow vulnerability by providing a specially crafted malicious file. This flaw, located in the uncompressed_fp_dng_load_raw functionality, leads to a heap buffer overflow. Successful exploitation may result in arbitrary code execution or a denial of service.

This flaw in the LibRaw library consists in an integer overflow in the uncompressed_fp_dng_load_raw function, a successfully performed attack may lead to a heap buffer overflow and potentially arbitrary code execution or denial of service. The vulnerability stems from the usage of a 32-bit arithmetic to calculate the pixel buffers when decoding the raw image file, which may end up overflowing when processing user controlled images as input. The calculation result is further used within 64-bit boundary checking however the proper cast is missing and the result value is used to allocate the buffer from memory, when the overflow happens the function may start writing outside of the expected memory boundary leading to data corruption.

This vulnerability is not exploitable when the application consuming LibRaw is using the default memory limit (max_raw_memory_mb parameter) to unpack the RAW image. To be considered vulnerable the application should be setting the limit to around or greater then 16GB.

Red Hat Product Security has rated this vulnerability as having a Moderate impact, despite the possibility of arbitrary code execution due to the heap-based buffer overflow, as the user needs to be tricked to process a maliciously crafted image or LibRaw needs to be exposed to the network and accepting untrusted data as input. Additionally the default max_raw_memory_mb value set with LibRaw is not enough to trigger the vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability can be mitigated by limiting the amount of memory used to unpack untrusted RAW images. This needs to be set in the application using the LibRaw and can be achieved by setting the max_raw_memory_mb to a value smaller than 16GB. This parameter can't be changed in runtime in the library, so developers needs to patch and rebuild their application to impose the new limit. It's important to notice the fact when reducing the memory limit for the decoding process may render the library unable to handle big images.