CVE-2026-20889

CVE-2026-20889 is a heap-based buffer overflow vulnerability in LibRaw's x3f_thumb_loader functionality (Commit d20315b) that can be exploited through specially crafted malicious files. The vulnerability allows attackers to trigger memory corruption by providing a malicious input file to applications utilizing the affected LibRaw library component. The vulnerability carries a critical CVSS score of 9.8, reflecting a network-accessible attack vector requiring no authentication, low complexity, and no user interaction. Exploitation results in complete system compromise with high impact to confidentiality, integrity, and availability. The FAUCET risk score of 54.0/100 indicates moderate assessed risk within LibRaw's user base. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and remains on inactive status for public exploit availability. The extremely low EPSS score of 0.0005 suggests minimal current real-world exploitation probability, though the critical severity rating warrants prompt patching of affected LibRaw installations.