CVE-2026-24450 is a high severity (CVSS 8.1) integer overflow in the uncompressed floating point DNG loader of LibRaw. A crafted file can cause a heap buffer overflow. The record names LibRaw commit 8dc68e2 and no fixed version, so check LibRaw's releases and your distribution.
What's affected
The record describes an integer overflow in the uncompressed_fp_dng_load_raw functionality of LibRaw at commit 8dc68e2. A specially crafted file can lead to a heap buffer overflow.
The only reference is a Cisco Talos report, TALOS-2026-2363, which returned a forbidden error when I tried to fetch it. I could not confirm affected version ranges or a fixed release, so check the Talos report and the LibRaw project directly.
How to check if you're exposed
LibRaw is usually a dependency of something else, such as photo tools, thumbnailers and image pipelines. Find where it comes from.
On Debian and Ubuntu:
dpkg -l | grep -i libraw
For application projects, check lockfiles and build files for LibRaw or wrappers that bundle it. Include servers that generate previews of uploaded photos.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Read the Talos report and the LibRaw release notes, and identify the first release that fixes it.
- Update LibRaw, or the package or wrapper that bundles it, once a fixed version is available.
- Until then, avoid processing DNG files from untrusted sources, or process them in a sandbox with low privileges.
- Rebuild application images that statically link LibRaw.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. A size calculation wraps to a small number, the program allocates too little memory, and a later copy writes past the end. File parsers are a classic home for this kind of bug, because the file controls the numbers.
The vector needs no privileges, but high complexity keeps the score at 8.1. Services that accept photo uploads are the most exposed. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Which release fixes it?
I could not confirm a fixed release from the sources I could read. Check the Talos report and LibRaw releases.
Who is most exposed?
Systems that automatically process DNG files from untrusted sources, such as upload and preview services.
Sources
Last reviewed: 19 October 2026.
