{"id":"CVE-2026-51235","aliases":["ALSA-2026:51105","EUVD-2026-49396","GHSA-fr9w-862r-x425","RHSA-2026:51105","RHSA-2026:61352","RHSA-2026:61353","RLSA-2026:51105","UBUNTU-CVE-2026-51235"],"status":"rejected","title":"LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and...","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-07-27T00:00:00Z","modified":"2026-10-29T11:32:36Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"LibRaw","fixed_in":["0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"LibRaw-devel","fixed_in":["0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw-debuginfo","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw-debugsource","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw-samples-debuginfo","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-debuginfo","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-debugsource","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-devel","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-samples-debuginfo","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw-debuginfo","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw-debugsource","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw-samples-debuginfo","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-debuginfo","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-debugsource","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-devel","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-samples-debuginfo","fixed_in":["0:0.21.1-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw","fixed_in":["0:0.21.1-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw-debuginfo","fixed_in":["0:0.21.1-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw-debugsource","fixed_in":["0:0.21.1-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw-samples-debuginfo","fixed_in":["0:0.21.1-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"LibRaw","fixed_in":["0:0.21.1-2.el9_8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"LibRaw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"LibRaw-samples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"LibRaw-samples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"LibRaw-samples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"LibRaw-samples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"LibRaw-samples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-2.el9_8.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51235","tags":["advisory"]},{"url":"https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51235","tags":["article"]},{"url":"http://libraw.com","tags":["article"]},{"url":"https://github.com/advisories/GHSA-fr9w-862r-x425"},{"url":"https://access.redhat.com/errata/RHSA-2026:51105","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51235","tags":["report"]},{"url":"https://bugzilla.redhat.com/2507594","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-51105.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507594","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51105.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-51235","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61352","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61352.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61353","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61353.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:51105","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-51235","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-51235","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2026-07-27T00:00:00Z","modified":"2026-07-31T14:33:57.338Z","updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-49396","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-31T14:33:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:26.304051Z"}],"ghsa":[{"id":"GHSA-fr9w-862r-x425","title":"LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and...","description":"LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decoders/fuji.cpp).","status":"published","published":"2026-07-27T18:31:50Z","modified":"2026-07-27T21:32:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:09:51.995252Z"}],"nvd":[{"id":"CVE-2026-51235","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2026-07-27T18:16:56.117Z","modified":"2026-07-31T15:16:28.533Z","updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"RHSA-2026:51105","title":"Red Hat Security Advisory: LibRaw security update","status":"published","published":"2026-08-07T10:28:40Z","modified":"2026-09-01T10:24:53Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:61352","title":"Red Hat Security Advisory: LibRaw security update","status":"published","published":"2026-09-01T10:28:19Z","modified":"2026-09-01T10:47:17.047678955Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61353","title":"Red Hat Security Advisory: LibRaw security update","status":"published","published":"2026-09-01T10:28:20Z","modified":"2026-09-01T10:47:50.138090169Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:51105","title":"Important: LibRaw security update","description":"LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).\n\nSecurity Fix(es):\n\n* LibRaw: LibRaw: Buffer Overflow vulnerability in image processing (CVE-2026-51235)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-07T06:04:24.506839Z","modified":"2026-08-07T06:30:05.488457159Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-51235","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2026-07-27T18:16:00Z","modified":"2026-08-06T22:15:24.992526605Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ALSA-2026:51105","title":"Important: LibRaw security update","description":"LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others).  \n\nSecurity Fix(es):  \n\n  * LibRaw: LibRaw: Buffer Overflow vulnerability in image processing (CVE-2026-51235)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-06T00:00:00Z","modified":"2026-10-29T11:32:36.469203203Z","updated_at":"2026-11-02T15:27:54.753319Z"}]}}