VulnSocial

CVE-2026-20889Disclosure(libraw / libraw)

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

libraw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-190CWE-120

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • libraw

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-04-08)
  • 3 total mentions across 2 days

Affected systems

Vendors
libraw
Products
libraw

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-07: 1Mentions · 2026-04-08: 2Technical Details · 2026-04-07: 1Technical Details · 2026-04-08: 204-0704-08
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-071
Disclosure1
2026-04-082
Disclosure2
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-20889 A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a hea… https://www.cve.org/CVERecord?id=CVE-2026-20889 ----- Traducción: CVE-2026-20889 Exi… http://infoflow.cloud`

    Post summary

    The text announces the discovery of CVE-2026-20889, describing it as a heap-based buffer overflow in LibRaw's x3f_thumb_loader component, but provides no PoC, exploit code, patch, or evidence of active exploitation.

    0000042
    67 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-20889 A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a hea… https://www.cve.org/CVERecord?id=CVE-2026-20889

    Post summary

    The update announces a heap‑based buffer overflow vulnerability in LibRaw's x3f_thumb_loader, providing technical details but no evidence of PoC, exploitation, or patch.

    00000278
    57.0K followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-20889: CRITICAL] Critical heap buffer overflow vulnerability discovered in LibRaw Commit d20315b x3f_thumb_loader. Attackers could exploit this flaw by providing a crafted file. #CyberSecurity#cve,CVE-2026-20889,#cybersecurity https://cvefind.com/CVE-2026-20889

    Post summary

    The tweet announces a critical heap buffer overflow in LibRaw's x3f_thumb_loader, noting that crafted files could exploit the flaw.

    0000027
    619 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applibrawlibraw0.22.0--

Explore more

Back to dashboardlibraw CVEslibraw vulnerabilities