========================================================================== Ubuntu Security Notice USN-8522-1 July 09, 2026
libraw vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in LibRaw. Software Description: - libraw: raw image decoder library Details: It was discovered that LibRaw incorrectly handled certain Nikon RAW image files. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service. (CVE-2026-5342) It was discovered that LibRaw had an integer overflow in its DNG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-20884) It was discovered that LibRaw incorrectly handled certain X3F thumbnail data. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-20889) It was discovered that LibRaw had a heap-based buffer overflow in its lossless JPEG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-21413) It was discovered that LibRaw had an integer overflow in its uncompressed floating-point DNG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2026-24450) It was discovered that LibRaw had a heap-based buffer overflow in its X3F Huffman decoder. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-24660) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libraw-bin 0.21.5b-1ubuntu1.1 libraw23t64 0.21.5b-1ubuntu1.1 Ubuntu 24.04 LTS libraw-bin 0.21.2-2.1ubuntu0.24.04.2 libraw23t64 0.21.2-2.1ubuntu0.24.04.2 Ubuntu 22.04 LTS libraw-bin 0.20.2-2ubuntu2.22.04.3 libraw20 0.20.2-2ubuntu2.22.04.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8522-1 CVE-2026-20884, CVE-2026-20889, CVE-2026-21413, CVE-2026-24450, CVE-2026-24660, CVE-2026-5342 Package Information: https://launchpad.net/ubuntu/+source/libraw/0.21.5b-1ubuntu1.1 https://launchpad.net/ubuntu/+source/libraw/0.21.2-2.1ubuntu0.24.04.2 https://launchpad.net/ubuntu/+source/libraw/0.20.2-2ubuntu2.22.04.3
signature.asc
Description: OpenPGP digital signature
