CVE-2026-20884: 
NixOS vulnerability analysis and mitigation

CVE-2026-20884 is an integer overflow vulnerability in the deflate_dng_load_raw functionality of LibRaw (Commit 8dc68e2) that leads to a heap buffer overflow when processing specially crafted DNG files. Discovered by Francesco Benvenuto of Cisco Talos, it was disclosed to the vendor on February 12, 2026, patched on April 6, 2026, and publicly released on April 7, 2026. The vulnerability carries a CVSSv3 score of 8.1 (High) per Talos/GitHub Advisory, though some sources estimate 9.8 (Critical) based on a network-accessible attack vector with no authentication required (Talos Report, GitHub Advisory).

The root cause is CWE-190 (Integer Overflow or Wraparound) in src/decoders/fp_dng.cpp. In deflate_dng_load_raw(), the buffer size calculation tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples * sizeof(float) performs the first four multiplications in 32-bit arithmetic before promoting to 64-bit for the final sizeof(float) factor — meaning the 32-bit product can wrap around before the result is assigned to an INT64 variable. This corrupted value then passes the memory limit check at step [2] and causes an undersized allocation at step [3]; subsequent memmove() calls at step [5] write tile data beyond the allocated buffer, resulting in a heap buffer overflow. Exploitation requires the application to have elevated max_raw_memory_mb (≥ ~11 GB) because a separate pre-decoder check in unpack.cpp using correct 64-bit arithmetic blocks large images under the default 2 GB limit, meaning only applications that explicitly raise this limit are vulnerable (Talos Report).

Successful exploitation can result in heap corruption and potential arbitrary code execution on systems running vulnerable LibRaw-based applications with elevated memory limits. All three security dimensions are affected: confidentiality (unauthorized data access), integrity (arbitrary memory writes), and availability (crash/denial of service). Because LibRaw is a widely embedded library used in image processing software, photo editors, and media pipelines, the blast radius extends to any downstream application that processes untrusted DNG files with a non-default max_raw_memory_mb setting (Talos Report, GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit or PoC file is publicly available — the Talos report provides source code analysis only, not an actionable attack artifact (Talos Report). The EPSS score is approximately 0.043–0.078%, placing it in the lower percentiles for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the precondition that the target application must have max_raw_memory_mb set above ~11 GB, limiting the practical attack surface to specialized high-resolution image processing deployments.

1. Identify target applications: Locate applications that use LibRaw (Commit 8dc68e2 or earlier) with max_raw_memory_mb configured above ~11,017 MB — such as high-resolution RAW image processing pipelines or photo editing tools with elevated memory settings.
2. Craft a malicious DNG file: Create a tiled DNG file with attacker-controlled TIFF tags: set ImageWidth=38000, ImageLength=38000, TileWidth=9500, TileHeight=9500, and SamplesPerPixel=3. These values cause the 32-bit multiplication 16 * 9500 * 9500 * 3 = 4,332,000,000 to exceed UINT32_MAX and wrap to 37,032,704.
3. Bypass the memory limit check: The overflowed value (~141 MB) is used in the in-function check at step [2], which passes any reasonable memory limit even though the true required size is ~16.1 GB. The pre-decoder check in unpack.cpp is bypassed because the elevated max_raw_memory_mb allows the image through.
4. Trigger undersized allocation: The same overflowed arithmetic at step [3] causes calloc() to allocate only ~141 MB instead of the ~16.1 GB actually needed.
5. Achieve heap buffer overflow: As the tile processing loops iterate using the original (correct) tile dimensions, memmove() writes tile data to addresses beyond the undersized float_raw_image buffer, corrupting adjacent heap memory.
6. Leverage heap corruption: With controlled heap layout, an attacker may redirect execution flow to achieve arbitrary code execution under the privileges of the LibRaw-consuming process (Talos Report).

• File System: Presence of unusually large or malformed DNG files (e.g., with ImageWidth/ImageLength ≥ 38000 and small tile dimensions) submitted to image processing services; unexpected files written to disk by the LibRaw-consuming process.
• Process: Crashes or abnormal termination of image processing applications with signals such as SIGSEGV or SIGABRT originating from LibRaw::deflate_dng_load_raw() in fp_dng.cpp; AddressSanitizer output referencing fp_dng.cpp:419.
• Logs: Application crash logs or core dumps referencing LibRaw::deflate_dng_load_raw(), LibRaw::unpack(), or __sanitizer_internal_memmove; error messages indicating a WRITE memory access fault at unexpected addresses.
• Network: Unexpected inbound delivery of large DNG files to image processing endpoints, particularly files with atypical TIFF tag combinations (very large image dimensions with small tile sizes) (Talos Report).

The vendor released a patch on April 6, 2026; users should update LibRaw to a version beyond Commit 8dc68e2 that addresses the integer overflow (GitHub Advisory). As an immediate workaround, ensure max_raw_memory_mb is kept at the default value (2048 MB / 2 GB) or below — this prevents the vulnerable code path from being reached because the pre-decoder check in unpack.cpp will reject oversized images before deflate_dng_load_raw() is called (Talos Report). Additionally, validate and sanitize all DNG input files before processing, implement sandboxing or process isolation for untrusted file handling, and restrict access to LibRaw-based processing to trusted sources only. Linux distribution packages (Fedora, openSUSE, Amazon Linux 2) have also issued updated packages addressing this vulnerability.

Cisco Talos published a detailed technical advisory (TALOS-2026-2364) crediting researcher Francesco Benvenuto with the discovery, and subsequently published a blog post covering LibRaw and Foxit vulnerabilities together (Talos Blog). The vulnerability was picked up by the oss-security mailing list and covered in Linux security advisories for Fedora, openSUSE, and Amazon Linux 2, indicating broad awareness in the open-source community. CISA included it in its weekly vulnerability bulletin for the week of April 6, 2026. Community reaction has been measured, noting the practical exploitation constraint of requiring elevated memory limits as a significant mitigating factor.