{"id":"ECHO-ddb8-c818-edca","summary":"Vulnerable code is not present in libraw 0.21.4 (the version shipped in\nDebian trixie). The CVE describes a heap out-of-bounds write in\nHuffTable::initval (src/decompressors/losslessjpeg.cpp), reachable via\nLibRaw::sony_ycbcr_load_raw -\u003e LibRaw_LjpegDecompressor::initialize -\u003e\nHuffTable::initval. None of those symbols exist in 0.21.4: the\nsrc/decompressors/ directory, the LibRaw_LjpegDecompressor class, and\nthe sony_ycbcr_load_raw entry point were all introduced together in\nlibraw 0.22.0.\n\nEmpirically confirmed by running the public PoC from\nhttps://github.com/biniamf/pocs/tree/main/libraw_lljpeg against an ASan\nbuild of unpatched libraw 0.21.4: the file is rejected at open with\n\"Unsupported file format or not RAW file\"; the same PoC reproduces the\nheap-buffer-overflow in 0.22.0 with the stack trace from the Talos\nreport.\n","modified":"2026-09-15T03:34:25.162857398Z","published":"2026-04-02T21:00:47.813881Z","withdrawn":"2026-05-04T12:45:02.377Z","upstream":["CVE-2026-5318"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-5318"}],"affected":[{"package":{"name":"libraw","ecosystem":"Echo","purl":"pkg:deb/echo/libraw"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.4"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-ddb8-c818-edca.json"}}],"schema_version":"1.9.0"}