{"id":"CVE-2026-5318","summary":"LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write","details":"A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.","modified":"2026-10-21T10:15:38.625090342Z","published":"2026-04-02T01:45:12.421Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"0.1"},{"last_affected":"0.1"},{"introduced":"0.2"},{"last_affected":"0.2"},{"introduced":"0.3"},{"last_affected":"0.3"},{"introduced":"0.4"},{"last_affected":"0.4"},{"introduced":"0.5"},{"last_affected":"0.5"},{"introduced":"0.6"},{"last_affected":"0.6"},{"introduced":"0.7"},{"last_affected":"0.7"},{"introduced":"0.8"},{"last_affected":"0.8"},{"introduced":"0.9"},{"last_affected":"0.9"},{"introduced":"0.10"},{"last_affected":"0.10"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-119","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5318.json"},"references":[{"type":"WEB","url":"https://github.com/LibRaw/LibRaw/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5318.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5318"},{"type":"ADVISORY","url":"https://vuldb.com/submit/780538"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/354650"},{"type":"REPORT","url":"https://github.com/LibRaw/LibRaw/issues/794"},{"type":"REPORT","url":"https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499"},{"type":"REPORT","url":"https://vuldb.com/vuln/354650/cti"},{"type":"FIX","url":"https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995"},{"type":"FIX","url":"https://github.com/LibRaw/LibRaw/releases/tag/0.22.1"},{"type":"EVIDENCE","url":"https://github.com/biniamf/pocs/tree/main/libraw_lljpeg"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libraw/libraw","events":[{"introduced":"76b3641bc36b9642d7bd0ee5d10591c456bd6b36"},{"fixed":"a6734e867b19d75367c05f872ac26322464e3995"},{"fixed":"b860248a89d9082b8e0a1e202e516f46af9adb29"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.11"},{"last_affected":"0.11"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.12"},{"last_affected":"0.12"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.13"},{"last_affected":"0.13"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.14"},{"last_affected":"0.14"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.15"},{"last_affected":"0.15"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.16"},{"last_affected":"0.16"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.17"},{"last_affected":"0.17"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.18"},{"last_affected":"0.18"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.19"},{"last_affected":"0.19"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.20"},{"last_affected":"0.20"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.21"},{"last_affected":"0.21"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.22.0"},{"last_affected":"0.22.0"}]},{"range":[{"fixed":"a6734e867b19d75367c05f872ac26322464e3995"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"0.22.1","range":[{"fixed":"b860248a89d9082b8e0a1e202e516f46af9adb29"}]}]}}],"versions":["0.11","0.12","0.13","0.14","0.15","0.16","0.17","0.18","0.19","0.20","0.21","0.22.0"],"database_specific":{"vanir_signatures_modified":"2026-10-21T10:15:38Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5318.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libraw/libraw/commit/a6734e867b19d75367c05f872ac26322464e3995","target":{"file":"src/decompressors/losslessjpeg.cpp","function":"HuffTable::initval"},"deprecated":false,"digest":{"function_hash":"133194446028387202039164538590990797554","length":1269},"id":"CVE-2026-5318-98442b3f"},{"signature_version":"v1","source":"https://github.com/libraw/libraw/commit/a6734e867b19d75367c05f872ac26322464e3995","target":{"file":"src/decompressors/losslessjpeg.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["326761413661156394820900884209946624484","9393470417408501326808684943003842057","235583240642029526265400839232551055324","255729870336141752472084508648059580457","232132406769837678194374120828729585056","275170039955600648939075200053395248899","277991561106811252586383934784330613761","328581871071293545468715766510115047561","291257287519693227265917942841836945041","298475588439797613578363806973380941942","90510277236790103263695028072102205737"]},"id":"CVE-2026-5318-c83540d1","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}