9.8

CVE-2026-20911

Exploit
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libraw ≫ Libraw Version0.22.0
Libraw ≫ Libraw Version0.22.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.5% 0.392
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
talos-cna@cisco.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

CWE-131 Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2330
Third Party Advisory
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2330
Third Party Advisory
Exploit
https://access.redhat.com/security/cve/CVE-2026-20911
https://bugzilla.redhat.com/show_bug.cgi?id=2455959
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20911.json