CVE-2026-21413

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.93%
EPSS Percentile: 59.67%
CISA KEV: Not listed

Description

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: talos-cna@cisco.com
Published: 07-Apr-2026 22:17
Last Modified: 14-Oct-2026 05:17
EPSS Date: 2026-10-13
CWE: CWE-129, CWE-787

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

libraw / libraw
Version / affected range: 0.22.0
cpe:2.3:a:libraw:libraw:0.22.0:*:*:*:*:*:*:*
libraw / libraw
Version / affected range: 0.22.1
cpe:2.3:a:libraw:libraw:0.22.1:*:*:*:*:*:*:*

References

Last enrichment sync: 14-Oct-2026 08:00
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

Patches have also been released for a non-Microsoft CVE (CVE-2026-21413, CVSS score: 9.8), a heap-based buffer overflow impacting Raw Image Extension that could result in remote code execution. Microsoft Patches 1,413 Vulnerabilities, Including Actively Exploited Windows Shell Flaw
CVE-2026-21413 Microsoft October 2026 Updates Fix 1,411 Flaws, Including Three Zero-Days
Microsoft also republished a Cisco Talos bug, CVE-2026-21413, which is listed as a raw image extension remote code execution (RCE) vulnerability. Microsoft’s October 2026 Patch Tuesday Fixes 1,413 CVEs, Including Two Zero-Days
CVE-2026-21413 is a Critical RCE vulnerability in Windows Raw Image Extension and has a CVSS score of 9.8. Microsoft’s October 2026 Patch Tuesday Fixes 1,413 Vulnerabilities, Including an Exploited Zero-Day

CVE (1237)

People (13)

MITRE ATT&CK (2)

Vendors (14)

Products (108)

Tools (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.