BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CVE-2026-21413

9.8 critical SSVC exploitation: none Modified
NVD · CVE.org

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Fix

Microsoft's update · Critical

  • Release Notes — Raw Image Extension on Windows 10 Version 1607, Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems, Raw Image Extension on Windows 10, Raw Image Extension on Windows 10 for 32-bit Systems, Raw Image Extension on Windows 10 Version 21H2, Raw Image Extension on Windows 10 Version 21H2 for 32-bit Systems, Raw Image Extension on Windows 10 Version 20H2, Raw Image Extension on Windows 10 Version 20H2 for 32-bit Systems, Raw Image Extension on Windows 10 Version 21H1 for 32-bit Systems, Raw Image Extension on Windows 10 Version 21H1, Raw Image Extension on Windows 10 Version 1909, Raw Image Extension on Windows 10 Version 1909 for 32-bit Systems, Raw Image Extension on Windows 10 Version 1809 for HoloLens, Raw Image Extension on Windows 10 Version 1809, Raw Image Extension on Windows 10 Version 1809 for 32-bit Systems · build 2.4.36.0
  • Release Notes — Raw Image Extension on Windows 11 version 21H2, Raw Image Extension on Windows 11 version 26H2, Raw Image Extension on Windows 11 Version 26H2 · build 2.5.35.0

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.

Vendor advisories in the News 1

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

  1. First seenCVSS 9.8 · librawNVD modified 2026-10-13 22:17

Affected (CPE criteria) 2

  • cpe:2.3:a:libraw:libraw:0.22.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libraw:libraw:0.22.1:*:*:*:*:*:*:*

References 15