CVE-2026-20911

CVE-2026-20911 is a heap-based buffer overflow vulnerability in the HuffTable::initval functionality of LibRaw that can be triggered by processing a specially crafted malicious file. The vulnerability affects LibRaw Commit 0b56545 and Commit d20315b, with potential impacts on any applications that depend on this library for image processing. The vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL due to its network-exploitable nature, low attack complexity, and lack of required privileges or user interaction. An attacker can achieve complete system compromise through the overflow, with high impact to confidentiality, integrity, and availability. The attack requires only a malicious file submission with no authentication or user interaction needed. Currently, CVE-2026-20911 is not listed in the Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The EPSS score of 0.0005 indicates this vulnerability is exploited less frequently than the vast majority of CVEs, and community attention remains low. However, given the critical severity rating, patch deployment should be prioritized once fixes become available.