CVE-2020-24870

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in...

8.8 HighFix available

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.62%Up 1.0 points since Jun 3, 2021

What each source reports

NVD Score used 8.8

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: CVE-2020-24870
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: CVE-2020-24870
Updated: 2026-11-02

EUVDEUVD-2020-17578 No score

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: EUVD-2020-17578
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p736-65cp-9pj8 8.8

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in...

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: GHSA-p736-65cp-9pj8
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 8.8

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: CVE-2020-24870
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-24870 8.8

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: DEBIAN-CVE-2020-24870
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVRHSA-2021:4381 9.8

Red Hat Security Advisory: GNOME security, bug fix, and enhancement update

Record: RHSA-2021:4381
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2021:4381 9.8

Moderate: GNOME security, bug fix, and enhancement update

GNOME is the default desktop environment of Rocky Linux.

The following packages have been upgraded to a later upstream version: gdm (40.0), webkit2gtk3 (2.32.3). (BZ#1909300)

Security Fix(es):

webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution (CVE-2020-13558)
LibRaw: Stack buffer overflow in LibRaw::identify_process_dng_fields() in identify.cpp (CVE-2020-24870)
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2020-27918)
webkitgtk: IFrame sandboxing policy violation (CVE-2021-1765)
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-1788)
webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-1789)
webkitgtk: Access to restricted ports on arbitrary servers via port redirection (CVE-2021-1799)
webkitgtk: IFrame sandboxing policy violation (CVE-2021-1801)
webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-1844)
webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1870)
webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1871)
webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution (CVE-2021-21775)
webkitgtk: Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution (CVE-2021-21779)
webkitgtk: Use-after-free in fireEventListeners leading to arbitrary code execution (CVE-2021-21806)
webkitgtk: Integer overflow leading to arbitrary code execution (CVE-2021-30663)
webkitgtk: Memory corruption leading to arbitrary code execution (CVE-2021-30665)
webkitgtk: Logic issue leading to leak of sensitive user information (CVE-2021-30682)
webkitgtk: Logic issue leading to universal cross site scripting attack (CVE-2021-30689)
webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers (CVE-2021-30720)
webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30734)
webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack (CVE-2021-30744)
webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30749)
webkitgtk: Type confusion leading to arbitrary code execution (CVE-2021-30758)
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30795)
webkitgtk: Insufficient checks leading to arbitrary code execution (CVE-2021-30797)
webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30799)
webkitgtk: User may be unable to fully delete browsing history (CVE-2020-29623)
gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (CVE-2020-36241)
gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix) (CVE-2021-28650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record: RLSA-2021:4381
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-24870 8.8

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

Record: UBUNTU-CVE-2020-24870
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2021:4381 No score

Moderate: GNOME security, bug fix, and enhancement update

GNOME is the default desktop environment of AlmaLinux.

The following packages have been upgraded to a later upstream version: gdm (40.0), webkit2gtk3 (2.32.3). (BZ#1909300)

Security Fix(es):

webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution (CVE-2020-13558)
LibRaw: Stack buffer overflow in LibRaw::identify_process_dng_fields() in identify.cpp (CVE-2020-24870)
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2020-27918)
webkitgtk: IFrame sandboxing policy violation (CVE-2021-1765)
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-1788)
webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-1789)
webkitgtk: Access to restricted ports on arbitrary servers via port redirection (CVE-2021-1799)
webkitgtk: IFrame sandboxing policy violation (CVE-2021-1801)
webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-1844)
webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1870)
webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1871)
webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution (CVE-2021-21775)
webkitgtk: Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution (CVE-2021-21779)
webkitgtk: Use-after-free in fireEventListeners leading to arbitrary code execution (CVE-2021-21806)
webkitgtk: Integer overflow leading to arbitrary code execution (CVE-2021-30663)
webkitgtk: Memory corruption leading to arbitrary code execution (CVE-2021-30665)
webkitgtk: Logic issue leading to leak of sensitive user information (CVE-2021-30682)
webkitgtk: Logic issue leading to universal cross site scripting attack (CVE-2021-30689)
webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers (CVE-2021-30720)
webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30734)
webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack (CVE-2021-30744)
webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30749)
webkitgtk: Type confusion leading to arbitrary code execution (CVE-2021-30758)
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30795)
webkitgtk: Insufficient checks leading to arbitrary code execution (CVE-2021-30797)
webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30799)
webkitgtk: User may be unable to fully delete browsing history (CVE-2020-29623)
gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (CVE-2020-36241)
gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix) (CVE-2021-28650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2021:4381
Updated: 2026-11-02

Affected products

libraw

Affected packages

Affected packages
Package	Affected	Fixed
`LibRaw` AlmaLinux:8 From an advisory covering 29 CVEs	before 0.19.5-3.el8	0.19.5-3.el8
`LibRaw-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 0.19.5-3.el8	0.19.5-3.el8
`accountsservice` AlmaLinux:8 From an advisory covering 29 CVEs	before 0.6.55-2.el8	0.6.55-2.el8
`accountsservice-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 0.6.55-2.el8	0.6.55-2.el8
`accountsservice-libs` AlmaLinux:8 From an advisory covering 29 CVEs	before 0.6.55-2.el8	0.6.55-2.el8
`gdm` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:40.0-15.el8	1:40.0-15.el8
`gnome-autoar` AlmaLinux:8 From an advisory covering 29 CVEs	before 0.2.3-2.el8	0.2.3-2.el8
`gnome-calculator` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.2-2.el8	3.28.2-2.el8
`gnome-classic-session` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-control-center` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.2-28.el8	3.28.2-28.el8

Show 130 moreShow less

Affected packages
Package	Affected	Fixed
`gnome-control-center-filesystem` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.2-28.el8	3.28.2-28.el8
`gnome-online-accounts` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.2-3.el8	3.28.2-3.el8
`gnome-online-accounts-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.2-3.el8	3.28.2-3.el8
`gnome-session` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.1-13.el8	3.28.1-13.el8
`gnome-session-kiosk-session` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.1-13.el8	3.28.1-13.el8
`gnome-session-wayland-session` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.1-13.el8	3.28.1-13.el8
`gnome-session-xsession` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.28.1-13.el8	3.28.1-13.el8
`gnome-settings-daemon` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.0-16.el8.alma	3.32.0-16.el8.alma
`gnome-shell` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.2-40.el8	3.32.2-40.el8
`gnome-shell-extension-apps-menu` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-auto-move-windows` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-common` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-dash-to-dock` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-desktop-icons` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-disable-screenshield` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-drive-menu` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-gesture-inhibitor` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-horizontal-workspaces` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-launch-new-instance` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-native-window-placement` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-no-hot-corner` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-panel-favorites` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-places-menu` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-screenshot-window-sizer` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-systemMonitor` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-top-icons` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-updates-dialog` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-user-theme` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-window-grouper` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-window-list` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-windowsNavigator` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-shell-extension-workspace-indicator` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.1-20.el8	3.32.1-20.el8
`gnome-software` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.36.1-10.el8	3.36.1-10.el8
`gnome-software-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.36.1-10.el8	3.36.1-10.el8
`gsettings-desktop-schemas` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.0-6.el8	3.32.0-6.el8
`gsettings-desktop-schemas-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.0-6.el8	3.32.0-6.el8
`gtk-update-icon-cache` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.22.30-8.el8	3.22.30-8.el8
`gtk3` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.22.30-8.el8	3.22.30-8.el8
`gtk3-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.22.30-8.el8	3.22.30-8.el8
`gtk3-immodule-xim` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.22.30-8.el8	3.22.30-8.el8
`mutter` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.2-60.el8	3.32.2-60.el8
`mutter-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.32.2-60.el8	3.32.2-60.el8
`vino` AlmaLinux:8 From an advisory covering 29 CVEs	before 3.22.0-11.el8	3.22.0-11.el8
`webkit2gtk3` AlmaLinux:8 From an advisory covering 29 CVEs	before 2.32.3-2.el8	2.32.3-2.el8
`webkit2gtk3-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 2.32.3-2.el8	2.32.3-2.el8
`webkit2gtk3-jsc` AlmaLinux:8 From an advisory covering 29 CVEs	before 2.32.3-2.el8	2.32.3-2.el8
`webkit2gtk3-jsc-devel` AlmaLinux:8 From an advisory covering 29 CVEs	before 2.32.3-2.el8	2.32.3-2.el8
`libraw` Debian:12	before 0.20.2-1	0.20.2-1
`libraw` Debian:13	before 0.20.2-1	0.20.2-1
`libraw` Debian:14	before 0.20.2-1	0.20.2-1
`webkit2gtk3` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-devel-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-jsc` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-jsc-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-jsc-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`webkit2gtk3-jsc-devel-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`LibRaw` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-samples-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`LibRaw-samples-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`gnome-autoar` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.2.3-2.el8	0:0.2.3-2.el8
`gnome-autoar-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.2.3-2.el8	0:0.2.3-2.el8
`gnome-autoar-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 0:0.2.3-2.el8	0:0.2.3-2.el8
`accountsservice` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:0.6.55-2.el8	0:0.6.55-2.el8
`gdm` Rocky Linux:8 From an advisory covering 29 CVEs	before 1:40.0-15.el8	1:40.0-15.el8
`gnome-autoar` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:0.2.3-2.el8	0:0.2.3-2.el8
`gnome-calculator` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.28.2-2.el8	0:3.28.2-2.el8
`gnome-control-center` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.28.2-28.el8	0:3.28.2-28.el8
`gnome-online-accounts` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.28.2-3.el8	0:3.28.2-3.el8
`gnome-session` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.28.1-13.el8	0:3.28.1-13.el8
`gnome-settings-daemon` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.32.0-16.el8	0:3.32.0-16.el8
`gnome-settings-daemon` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.32.0-16.el8_6.1	0:3.32.0-16.el8_6.1
`gnome-shell` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.32.2-40.el8	0:3.32.2-40.el8
`gnome-shell-extensions` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.32.1-20.el8	0:3.32.1-20.el8
`gnome-software` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.36.1-10.el8	0:3.36.1-10.el8
`gsettings-desktop-schemas` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.32.0-6.el8	0:3.32.0-6.el8
`gtk3` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.22.30-8.el8	0:3.22.30-8.el8
`LibRaw` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:0.19.5-3.el8	0:0.19.5-3.el8
`mutter` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.32.2-60.el8	0:3.32.2-60.el8
`vino` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:3.22.0-11.el8	0:3.22.0-11.el8
`webkit2gtk3` Rocky Linux:8 From an advisory covering 29 CVEs	before 0:2.32.3-2.el8	0:2.32.3-2.el8
`darktable` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.8-11.6.9-12.0.0-12.0.1-12.0.3-1	None known
`dcraw` Ubuntu:16.04:LTS	All versions, plus listed versions 9.21-0.2	None known
`exactimage` Ubuntu:16.04:LTS	All versions, plus listed versions 0.9.1-6build10.9.1-6ubuntu10.9.1-8ubuntu10.9.1-90.9.1-9build1 Show 4 moreShow less 0.9.1-100.9.1-110.9.1-120.9.1-12ubuntu1	None known
`kodi` Ubuntu:16.04:LTS	All versions, plus listed versions 15.1+dfsg1-315.2+dfsg1-1build115.2+dfsg1-315.2+dfsg1-3ubuntu115.2+dfsg1-3ubuntu1.1	None known
`rawtherapee` Ubuntu:16.04:LTS	All versions, plus listed versions 4.2-2build14.2-4	None known
`ufraw` Ubuntu:16.04:LTS	All versions, plus listed versions 0.20-3build1	None known
`darktable` Ubuntu:18.04:LTS	All versions, plus listed versions 2.2.5-22.4.0-12.4.1-12.4.2-1	None known
`dcraw` Ubuntu:18.04:LTS	All versions, plus listed versions 9.27-1ubuntu1	None known
`exactimage` Ubuntu:18.04:LTS	All versions, plus listed versions 0.9.2-1build11.0.1-1	None known
`kodi` Ubuntu:18.04:LTS	All versions, plus listed versions 2:17.3+dfsg1-32:17.3+dfsg1-3build12:17.3+dfsg1-52:17.3+dfsg1-5build12:17.3+dfsg1-5build22:17.6+dfsg1-12:17.6+dfsg1-1build12:17.6+dfsg1-1ubuntu1	None known
`rawtherapee` Ubuntu:18.04:LTS	All versions, plus listed versions 5.2-15.3-1	None known
`ufraw` Ubuntu:18.04:LTS	All versions, plus listed versions 0.22-1.10.22-20.22-30.22-3.1~build0.18.04.10.22-3.1ubuntu0.1	None known
`darktable` Ubuntu:20.04:LTS	All versions, plus listed versions 2.6.0-12.6.2-32.6.3-12.6.3-1build12.6.3-1build23.0.1-0ubuntu1	None known
`dcraw` Ubuntu:20.04:LTS	All versions, plus listed versions 9.28-2	None known
`exactimage` Ubuntu:20.04:LTS	All versions, plus listed versions 1.0.2-31.0.2-5ubuntu11.0.2-5ubuntu21.0.2-7ubuntu11.0.2-7ubuntu2	None known
`kodi` Ubuntu:20.04:LTS	All versions, plus listed versions 2:17.6+dfsg1-4ubuntu42:17.6+dfsg1-4ubuntu92:17.6+dfsg1-4ubuntu102:18.5+dfsg1-0ubuntu32:18.6+dfsg1-2ubuntu1	None known
`rawtherapee` Ubuntu:20.04:LTS	All versions, plus listed versions 5.6-15.7-15.8-1	None known
`darktable` Ubuntu:22.04:LTS	All versions, plus listed versions 3.6.0-0ubuntu13.8.0-23.8.0-33.8.0-3build13.8.0-3build23.8.1-13.8.1-2	None known
`dcraw` Ubuntu:22.04:LTS	All versions, plus listed versions 9.28-29.28-3	None known
`exactimage` Ubuntu:22.04:LTS	All versions, plus listed versions 1.0.2-81.0.2-8build11.0.2-8build21.0.2-8build3	None known
`kodi` Ubuntu:22.04:LTS	All versions, plus listed versions 2:19.1+dfsg2-22:19.3+dfsg1-12:19.3+dfsg1-1build22:19.3+dfsg1-1build32:19.3+dfsg1-1build42:19.3+dfsg1-1build52:19.4+dfsg1-2	None known
`rawtherapee` Ubuntu:22.04:LTS	All versions, plus listed versions 5.8-3	None known
`darktable` Ubuntu:24.04:LTS	All versions, plus listed versions 4.4.2-1ubuntu14.4.2-1ubuntu24.4.2-1.14.4.2-1.1build14.6.1-24.6.1-2build34.6.1-2build44.6.1-2ubuntu1	None known
`dcraw` Ubuntu:24.04:LTS	All versions, plus listed versions 9.28-39.28-3.1ubuntu19.28-5ubuntu1	None known
`exactimage` Ubuntu:24.04:LTS	All versions, plus listed versions 1.0.2-11build21.0.2-11build31.0.2-11build41.0.2-11build71.0.2-11build81.0.2-11build9	None known
`kodi` Ubuntu:24.04:LTS	All versions, plus listed versions 2:20.2+dfsg-42:20.2+dfsg-4build12:20.2+dfsg-4build22:20.2+dfsg-4ubuntu12:20.3+dfsg-12:20.4+dfsg-12:20.5+dfsg-1build22:20.5+dfsg-1ubuntu1	None known
`rawtherapee` Ubuntu:24.04:LTS	All versions, plus listed versions 5.9-1build15.9-25.10-15.10-1build35.10-1build4	None known
`darktable` Ubuntu:25.10	All versions, plus listed versions 5.0.1-0ubuntu15.0.1-0ubuntu25.0.1-15.0.1-2	None known
`dcraw` Ubuntu:25.10	All versions, plus listed versions 9.28-8	None known
`exactimage` Ubuntu:25.10	All versions, plus listed versions 1.2.1-2	None known
`kodi` Ubuntu:25.10	All versions, plus listed versions 2:21.2+dfsg-1build22:21.2+dfsg-42:21.2+dfsg-4build12:21.2+dfsg-4build2	None known
`rawtherapee` Ubuntu:25.10	All versions, plus listed versions 5.11-2build2	None known
`darktable` Ubuntu:26.10	All versions, plus listed versions 5.4.1-15.4.1-1build15.4.1-1build2	None known
`dcraw` Ubuntu:26.10	All versions, plus listed versions 9.28-8build1	None known
`exactimage` Ubuntu:26.10	All versions, plus listed versions 1.2.1-2build21.2.1-3build11.2.1-3build2	None known
`kodi` Ubuntu:26.10	All versions, plus listed versions 2:21.3+dfsg-1ubuntu12:21.3+dfsg-1.2	None known
`rawtherapee` Ubuntu:26.10	All versions, plus listed versions 5.12-25.12-2build1	None known
`darktable` Ubuntu:26.04:LTS	All versions, plus listed versions 5.0.1-25.2.1-15.2.1-1build15.2.1-1build25.4.0-15.4.1-1	None known
`dcraw` Ubuntu:26.04:LTS	All versions, plus listed versions 9.28-89.28-8build1	None known
`exactimage` Ubuntu:26.04:LTS	All versions, plus listed versions 1.2.1-21.2.1-2build11.2.1-2build2	None known
`kodi` Ubuntu:26.04:LTS	All versions, plus listed versions 2:21.2+dfsg-4build22:21.2+dfsg-4build32:21.2+dfsg-52:21.3+dfsg-12:21.3+dfsg-1build12:21.3+dfsg-1ubuntu1	None known
`rawtherapee` Ubuntu:26.04:LTS	All versions, plus listed versions 5.11-2build25.12-15.12-2	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24870 is a high vulnerability (CVSS 8.8) in Libraw, published June 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in libraw 0.20.2-1.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 70 references. The JSON record has them.