Medium severity4.3NVD Advisory· Published Apr 2, 2026· Updated Apr 29, 2026
CVE-2026-5318
CVE-2026-5318
Description
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
Affected products
1Patches
1a6734e867b19https://github.com/LibRaw/LibRawvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995nvdPatch
- github.com/biniamf/pocs/tree/main/libraw_lljpegnvdExploitThird Party Advisory
- vuldb.com/submit/780538nvdExploitThird Party AdvisoryVDB Entry
- vuldb.com/vuln/354650nvdThird Party AdvisoryVDB Entry
- github.com/LibRaw/LibRaw/issues/794nvdIssue Tracking
- github.com/LibRaw/LibRaw/issues/794nvdIssue Tracking
- github.com/LibRaw/LibRaw/releases/tag/0.22.1nvdProductRelease Notes
- vuldb.com/vuln/354650/ctinvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.