Every CVE Search/ Get API key

CVE-2026-51235

LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and...

8.8 HighFix availableRejected

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-fr9w-862r-x425 8.8

LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and...

LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decoders/fuji.cpp).

Record
GHSA-fr9w-862r-x425
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
CVE List No score

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2026-51235
Updated
2026-11-02
EUVDEUVD-2026-49396 8.8

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
EUVD-2026-49396
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD No score

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2026-51235
Updated
2026-11-02
OSVRHSA-2026:51105 7.3

Red Hat Security Advisory: LibRaw security update

Record
RHSA-2026:51105
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61352 7.3

Red Hat Security Advisory: LibRaw security update

Record
RHSA-2026:61352
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2026:61353 7.3

Red Hat Security Advisory: LibRaw security update

Record
RHSA-2026:61353
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:51105 7.3

Important: LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).

Security Fix(es):

  • LibRaw: LibRaw: Buffer Overflow vulnerability in image processing (CVE-2026-51235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:51105
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-51235 8.8

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
UBUNTU-CVE-2026-51235
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:51105 No score

Important: LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).

Security Fix(es):

  • LibRaw: LibRaw: Buffer Overflow vulnerability in image processing (CVE-2026-51235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:51105
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
LibRaw
AlmaLinux:9
 before 0.21.1-2.el9_8.1
0.21.1-2.el9_8.1
LibRaw-devel
AlmaLinux:9
 before 0.21.1-2.el9_8.1
0.21.1-2.el9_8.1
LibRaw
Red Hat:enterprise_linux:9::appstream
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-samples-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-devel
Red Hat:enterprise_linux:9::crb
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
LibRaw-samples-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
LibRaw
Red Hat:rhel_eus:9.6::appstream
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-samples-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-debuginfo
Red Hat:rhel_eus:9.6::crb
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-debugsource
Red Hat:rhel_eus:9.6::crb
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-devel
Red Hat:rhel_eus:9.6::crb
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw-samples-debuginfo
Red Hat:rhel_eus:9.6::crb
 before 0:0.21.1-2.el9_6.1
0:0.21.1-2.el9_6.1
LibRaw
Red Hat:rhel_e4s:9.4::appstream
 before 0:0.21.1-2.el9_4.1
0:0.21.1-2.el9_4.1
LibRaw-debuginfo
Red Hat:rhel_e4s:9.4::appstream
 before 0:0.21.1-2.el9_4.1
0:0.21.1-2.el9_4.1
LibRaw-debugsource
Red Hat:rhel_e4s:9.4::appstream
 before 0:0.21.1-2.el9_4.1
0:0.21.1-2.el9_4.1
LibRaw-samples-debuginfo
Red Hat:rhel_e4s:9.4::appstream
 before 0:0.21.1-2.el9_4.1
0:0.21.1-2.el9_4.1
LibRaw
Rocky Linux:9
 before 0:0.21.1-2.el9_8.1
0:0.21.1-2.el9_8.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-51235 has been rejected by its source and should not be treated as a live vulnerability, published July 27, 2026. Fixed in LibRaw 0.21.1-2.el9_8.1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open