CVE-2026-5342
Description
A flaw was found in LibRaw. A remote attacker could exploit this vulnerability by manipulating the load_flags or raw_width arguments within the LibRaw::nikon_load_padded_packed_raw function. This manipulation can lead to an out-of-bounds read, potentially causing application instability or a denial of service.
Statement
Moderate impact. A flaw in LibRaw allows a remote attacker to trigger an out-of-bounds read by manipulating load_flags or raw_width arguments when processing specially crafted raw image files. This can lead to application instability or a denial of service. Red Hat products utilizing LibRaw to process untrusted raw image files are affected.
Mitigation
To mitigate this issue, avoid processing untrusted or maliciously crafted Nikon raw image files with applications that use LibRaw. This operational control prevents the exploitation of the out-of-bounds read vulnerability by limiting exposure to potentially harmful input.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
