CVE-2026-21413

OVERVIEW CVE-2026-21413 is a heap-based buffer overflow vulnerability affecting LibRaw in the lossless_jpeg_load_raw functionality, specifically impacting Commit 0b56545 and Commit d20315b. The vulnerability can be triggered when processing specially crafted malicious image files, allowing attackers to exploit the memory handling flaw. SEVERITY This vulnerability carries a CRITICAL severity rating with a CVSS v3.1 score of 9.8. The attack requires no user privileges, can be executed remotely over the network, and demands minimal technical complexity to exploit. The threat model involves no user interaction, and successful exploitation results in complete system compromise with high confidentiality, integrity, and availability impacts. EXPLOITATION STATUS The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and remains in an inactive status on threat tracking lists. The EPSS score of 0.0005 indicates a relatively lower probability of exploitation compared to other vulnerabilities in the wild, though the critical CVSS rating warrants immediate attention. The FAUCET Risk Score of 54.0/100 reflects moderate community concern, suggesting this should be prioritized for patching despite currently low active exploitation indicators.