CVE-2026-24450 Integer overflow in LibRaw
A crafted DNG file triggers an integer overflow leading to heap buffer overflow in LibRaw, potentially allowing code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24450?
CVE-2026-24450 is a high-severity vulnerability in Libraw Libraw, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Weakness: CWE-190
Which versions are affected by CVE-2026-24450?
It affects 1 product.
Products include Libraw Libraw.
How do I fix CVE-2026-24450?
Apply the vendor's patch.
Is CVE-2026-24450 being exploited?
There is no known exploitation of CVE-2026-24450 in the wild and no public exploit code.
Other vulnerabilities in Libraw Libraw
Sources
Also known as AZL-82946, DEBIAN-CVE-2026-24450, ECHO-8d16-7d9a-2e99, GHSA-rhmw-w7w3-c647, JLSEC-2026-1116, UBUNTU-CVE-2026-24450.