A memory corruption vulnerability (CVE-2026-24660, CVSS 8.1 HIGH) in the LibRaw library allows for potential exploitation via processing a malicious RAW image file. According to the NVD, LibRaw version 0.22.0 is affected. The Red Hat security update provides patched packages for specific RHEL 8.8 Extended Update Support and Update Services channels, but a general fixed upstream version number is not provided in the available data.
Red Hat Product Errata RHSA-2026:15924 - Security Advisory Issued: 2026-05-11 Updated: 2026-05-11 RHSA-2026:15924 - Security Advisory Overview Updated Packages Synopsis Important: LibRaw security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for LibRaw is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): LibRaw: LibRaw: Memory Corruption via Malicious File Processing (CVE-2026-24660) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64 Red Hat Enterprise Linux Server - TUS 8.8 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 Fixes BZ - 2455926 - CVE-2026-24660 LibRaw: LibRaw: Memory Corruption via Malicious File Processing CVEs CVE-2026-24660 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 SRPM LibRaw-0.19.5-3.el8_8.2.src.rpm SHA-256: fa54364433bc9da53005dda9de1e94448c61a4c3acddf3247026a52359b8f55e x86_64 LibRaw-0.19.5-3.el8_8.2.i686.rpm SHA-256: bc17b9775f2904326dbcb400268534fcfbb8e0d4edac8282a3e60ec59766fa0c LibRaw-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: a1cac89514d47bdb4f0a6eb46b5a10ea82b0d1391f4f62bd6dd043ea3283e7e9 LibRaw-debuginfo-0.19.5-3.el8_8.2.i686.rpm SHA-256: 4409a59fb5bc9614936715f3ab3e09116d80fb5c1b230b0cbce4422ae36cc002 LibRaw-debuginfo-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: be6979d2933eba19d9291f00f2e911e565c88daa4fd8e0d23f4a5f06386a0a5a LibRaw-debugsource-0.19.5-3.el8_8.2.i686.rpm SHA-256: dfd697b838263abd7d272cbcb2462c64dfb54cd8e2926f23b8cff651d8225822 LibRaw-debugsource-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: 542587d92819eab114e3b95d7a5157c819b99ba0c25570a1242913dc437c6b38 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.i686.rpm SHA-256: af11f70ded4cb3285395a9805e3b785a7e466473d04e601c75d40aff8ef7aaf7 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: 9a37b5de036cc0cb9005c68c495356126fcb0d37ec968ed9c5cdcb90474de1e2 Red Hat Enterprise Linux Server - TUS 8.8 SRPM LibRaw-0.19.5-3.el8_8.2.src.rpm SHA-256: fa54364433bc9da53005dda9de1e94448c61a4c3acddf3247026a52359b8f55e x86_64 LibRaw-0.19.5-3.el8_8.2.i686.rpm SHA-256: bc17b9775f2904326dbcb400268534fcfbb8e0d4edac8282a3e60ec59766fa0c LibRaw-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: a1cac89514d47bdb4f0a6eb46b5a10ea82b0d1391f4f62bd6dd043ea3283e7e9 LibRaw-debuginfo-0.19.5-3.el8_8.2.i686.rpm SHA-256: 4409a59fb5bc9614936715f3ab3e09116d80fb5c1b230b0cbce4422ae36cc002 LibRaw-debuginfo-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: be6979d2933eba19d9291f00f2e911e565c88daa4fd8e0d23f4a5f06386a0a5a LibRaw-debugsource-0.19.5-3.el8_8.2.i686.rpm SHA-256: dfd697b838263abd7d272cbcb2462c64dfb54cd8e2926f23b8cff651d8225822 LibRaw-debugsource-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: 542587d92819eab114e3b95d7a5157c819b99ba0c25570a1242913dc437c6b38 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.i686.rpm SHA-256: af11f70ded4cb3285395a9805e3b785a7e466473d04e601c75d40aff8ef7aaf7 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: 9a37b5de036cc0cb9005c68c495356126fcb0d37ec968ed9c5cdcb90474de1e2 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 SRPM LibRaw-0.19.5-3.el8_8.2.src.rpm SHA-256: fa54364433bc9da53005dda9de1e94448c61a4c3acddf3247026a52359b8f55e ppc64le LibRaw-0.19.5-3.el8_8.2.ppc64le.rpm SHA-256: ee2e34c3a91f2a9d0e144bb3f515556e4feffc2330d1b33ce911ccf14548974f LibRaw-debuginfo-0.19.5-3.el8_8.2.ppc64le.rpm SHA-256: 750bcd859936d0d6f1f58397f52e76edf2e2e13864026d2caa7a7e13a095c2f2 LibRaw-debugsource-0.19.5-3.el8_8.2.ppc64le.rpm SHA-256: 6a9623621e11c7470f3fac32b0b67cb30a7c66b21d603dec5c13347381c3f040 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.ppc64le.rpm SHA-256: cf77606a15715a02f9bae9bc1d5b2c7a4529346f50039d893e63319e08f523be Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 SRPM LibRaw-0.19.5-3.el8_8.2.src.rpm SHA-256: fa54364433bc9da53005dda9de1e94448c61a4c3acddf3247026a52359b8f55e x86_64 LibRaw-0.19.5-3.el8_8.2.i686.rpm SHA-256: bc17b9775f2904326dbcb400268534fcfbb8e0d4edac8282a3e60ec59766fa0c LibRaw-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: a1cac89514d47bdb4f0a6eb46b5a10ea82b0d1391f4f62bd6dd043ea3283e7e9 LibRaw-debuginfo-0.19.5-3.el8_8.2.i686.rpm SHA-256: 4409a59fb5bc9614936715f3ab3e09116d80fb5c1b230b0cbce4422ae36cc002 LibRaw-debuginfo-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: be6979d2933eba19d9291f00f2e911e565c88daa4fd8e0d23f4a5f06386a0a5a LibRaw-debugsource-0.19.5-3.el8_8.2.i686.rpm SHA-256: dfd697b838263abd7d272cbcb2462c64dfb54cd8e2926f23b8cff651d8225822 LibRaw-debugsource-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: 542587d92819eab114e3b95d7a5157c819b99ba0c25570a1242913dc437c6b38 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.i686.rpm SHA-256: af11f70ded4cb3285395a9805e3b785a7e466473d04e601c75d40aff8ef7aaf7 LibRaw-samples-debuginfo-0.19.5-3.el8_8.2.x86_64.rpm SHA-256: 9a37b5de036cc0cb9005c68c495356126fcb0d37ec968ed9c5cdcb90474de1e2 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .