An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 7, 2026 · NIST NVD

   Detected

   An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

2. Jun 17, 2026 · NIST NVD

   Updated

   An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Affected

• cpe libraw/libraw0.22.1

Sources

• CVE.orgVulnerability recordCVE-2026-20884

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-20884

  An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

  nvd.nist.gov

References

• Exploit · talosintelligence.com
• Exploit · talosintelligence.com