NIXPKGS-2026-1008
GitHub issue
published on
Permalink
CVE-2026-21413
9.8 CRITICAL
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package libraw1394
- @LeSuisse accepted
- @LeSuisse published on GitHub
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality …
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
References
Affected products
LibRaw
- ==Commit 0b56545
- ==Commit d20315b