CVE-2026-20884 is a high severity integer overflow (CVSS 8.1) in the deflate_dng_load_raw function of LibRaw, which leads to a heap buffer overflow when a program opens a crafted file. The record names commit 8dc68e2. I could not confirm a fixed version, so check the project and your distribution.
What's affected
The record names LibRaw at commit 8dc68e2. It describes an integer overflow in the deflate_dng_load_raw functionality, which is the code path that loads DNG raw photos using deflate compression. The weakness is CWE-190 (integer overflow or wraparound). The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
The only reference is a Cisco Talos report (TALOS-2026-2364), and its page was blocked when I tried to read it, so I could not confirm a fixed version from the source. The record does not say whether this is fixed. Check the LibRaw project and your vendor.
The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. LibRaw is a library, so your exposure comes through the programs that link it: photo editors, image viewers, thumbnailers and web services that process uploaded photos.
How to check if you're exposed
Find out where LibRaw lives in your estate. On Linux, ask the package manager.
dpkg -l | grep -i libraw
rpm -qa | grep -i libraw
ldconfig -p | grep -i libraw
For Python projects, the rawpy package wraps LibRaw.
pip show rawpy
For containers and projects with a lockfile or an SBOM, search for libraw and rawpy. The free in-browser scan can read a manifest and flag known issues in your dependencies. Also look for services that accept photo uploads and convert them on the server, since they are where untrusted files meet the library.
What to do now
- Inventory every program and service that uses LibRaw, directly or through a wrapper such as rawpy.
- Check the LibRaw project and your Linux distribution for a release that addresses CVE-2026-20884, then upgrade the library and rebuild anything that links it statically.
- For services that process uploaded photos, run the conversion in a separate low privilege process or container with memory limits.
- Do not open DNG files from unknown sources in desktop tools until the fix is installed.
- Add LibRaw to your continuous dependency monitoring so a future fix shows up as an alert.
Why it matters
An integer overflow happens when a calculation produces a number too large for its type and wraps around to a small one. If that number is then used to size a memory buffer, the buffer ends up too small for the data copied into it, and the copy overruns it on the heap. Heap overflows can corrupt memory and crash the program, and in some cases they allow code execution.
The complication with libraries is that nobody installs them on purpose. LibRaw arrives inside a photo tool, a thumbnail service or a Python wheel. The first job is to find it, and that is an inventory question.
The demo below shows how a dependency inventory answers the question "where is this library?" for a whole project.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a vulnerable library always an exploitable one?
No. It matters whether your code calls the affected function with untrusted input. Reachability analysis looks at that. A service that opens user uploaded DNG files is much more exposed than a tool that only processes your own photos.
Sources
- Cisco Talos report TALOS-2026-2364 (listed in the record; the page was blocked during review)
- NVD record for CVE-2026-20884
Last reviewed: 19 October 2026.
