Log in Start free

Vulnerability · Published Apr 2, 2026 · Assigned by VulDB

CVE-2026-5342LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds

Medium 5.3

In plain English

A medium-severity out-of-bounds read in LibRaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.8%top 44.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libraw0.20.2-2.1+deb12u2DEBIAN-CVE-2026-5342
Debian:13libraw0.21.4-2+deb13u1DEBIAN-CVE-2026-5342
Debian:14libraw0.22.1-1DEBIAN-CVE-2026-5342
Ubuntu:22.04:LTSdarktableno fix listedUBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSdarktableno fix listedUBUNTU-CVE-2026-5342
Ubuntu:25.10darktableno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSdarktableno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.10darktableno fix listedUBUNTU-CVE-2026-5342
Ubuntu:22.04:LTSdcrawno fix listedUBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSdcrawno fix listedUBUNTU-CVE-2026-5342
Ubuntu:25.10dcrawno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSdcrawno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.10dcrawno fix listedUBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSdigikamno fix listedUBUNTU-CVE-2026-5342
Ubuntu:25.10digikamno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSdigikamno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.10digikamno fix listedUBUNTU-CVE-2026-5342
Ubuntu:22.04:LTSexactimageno fix listedUBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSexactimageno fix listedUBUNTU-CVE-2026-5342
Ubuntu:25.10exactimageno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSexactimageno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.10exactimageno fix listedUBUNTU-CVE-2026-5342
Ubuntu:22.04:LTSkodino fix listedUBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSkodino fix listedUBUNTU-CVE-2026-5342
Ubuntu:25.10kodino fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSkodino fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.10kodino fix listedUBUNTU-CVE-2026-5342
Ubuntu:22.04:LTSlibraw0.20.2-2ubuntu2.22.04.3USN-8522-1
Ubuntu:22.04:LTSlibraw0.20.2-2ubuntu2.22.04.3UBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSlibraw0.21.2-2.1ubuntu0.24.04.2UBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSlibraw0.21.2-2.1ubuntu0.24.04.2USN-8522-1
Ubuntu:25.10librawno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSlibraw0.21.5b-1ubuntu1.1UBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSlibraw0.21.5b-1ubuntu1.1USN-8522-1
Ubuntu:22.04:LTSrawtherapeeno fix listedUBUNTU-CVE-2026-5342
Ubuntu:24.04:LTSrawtherapeeno fix listedUBUNTU-CVE-2026-5342
Ubuntu:25.10rawtherapeeno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.04:LTSrawtherapeeno fix listedUBUNTU-CVE-2026-5342
Ubuntu:26.10rawtherapeeno fix listedUBUNTU-CVE-2026-5342

Affected products (as reported)

VendorProductVersions
n/a LibRaw 0.10.20.30.40.50.60.70.8

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References