CVE-2026-5318
LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write
Summary
LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write
Original description
The description as published by the source.
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-5318 libraw
- Ubuntu UBUNTU-CVE-2026-5318 darktable
References
- advisory github.com
- advisory nvd.nist.gov
- advisory vuldb.com
- advisory vuldb.com
- patch github.com
- patch github.com
- report github.com
- report github.com
- report vuldb.com
- report github.com
- web github.com