CVE-2026-5318: 
NixOS vulnerability analysis and mitigation

CVE-2026-5318 is a heap out-of-bounds write vulnerability in LibRaw's JPEG DHT (Define Huffman Table) parser, specifically in the HuffTable::initval function within src/decompressors/losslessjpeg.cpp. It affects LibRaw versions up to and including 0.22.0, and was disclosed on April 2, 2026, following discovery and reporting by researcher biniamf on March 15, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, Feedly). The fix was released in LibRaw 0.22.1 and is also tracked as TALOS-2026-2330 (LibRaw Commit).

The root cause is an improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-787). In HuffTable::initval(), the Huffman lookup table is allocated with 1 << nbits entries, but the number of entries written is derived from attacker-controlled bits[] values parsed from the JPEG DHT segment — with no validation that the total write count fits within the allocation (LibRaw Issue #794). Specifically, the upstream parse_dht() function only checks that the total symbol count is ≤ 256, without verifying that the Huffman code distribution forms a valid prefix-free tree. A malformed DHT segment with bits[1]=3 (three 1-bit codes) causes three writes into a 2-entry table, writing one entry past the end of the std::vector heap allocation at line 374 of losslessjpeg.cpp (PoC Repo). The attack is triggered remotely by delivering a crafted TIFF or JPEG file that requires user interaction to process.

Successful exploitation results in a heap buffer overflow write, which in the observed cases causes an application crash (denial of service) when LibRaw processes a maliciously crafted image file. The primary impact is availability — the application using LibRaw (e.g., RAW image viewers, converters, or photo processing pipelines) becomes unavailable (GitHub Advisory). There is no evidence of confidentiality or integrity impact at this time; however, heap out-of-bounds writes can in theory be leveraged for more severe exploitation depending on heap layout and memory protections in the host application. Any software embedding LibRaw for processing user-supplied image files — including web services, desktop applications, and image processing pipelines — is within the affected asset scope.

A public proof-of-concept exploit is available on GitHub, consisting of a malformed TIFF file (poc_lljpeg_hufftable.tif) and concrete reproduction steps (PoC Repo). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open or process the malicious file — limiting automated exploitation potential.

1. Craft malicious image file: Create or use the publicly available poc_lljpeg_hufftable.tif — a TIFF file wrapping a minimal lossless JPEG tile with a malformed DHT segment where bits[1]=3, specifying three 1-bit Huffman codes for a table sized for only 2 entries (PoC Repo).
2. Deliver the file to the target: Distribute the malicious TIFF/JPEG via email attachment, file upload to a web service, shared storage, or any channel where the victim application will process it (user interaction required).
3. Trigger LibRaw parsing: The victim application (e.g., simple_dcraw, a RAW viewer, or any LibRaw-linked software) opens the file, invoking LibRaw::unpack() → LibRaw::sony_ycbcr_load_raw() → LibRaw_LjpegDecompressor → HuffTable::initval().
4. Trigger out-of-bounds write: The malformed bits[] values cause the write loop at losslessjpeg.cpp:374 to write beyond the allocated hufftable vector boundary, resulting in a heap buffer overflow.
5. Achieve denial of service: The heap corruption causes the application to crash. Under specific heap layouts and without memory protections, further exploitation for code execution may theoretically be possible (LibRaw Issue #794).

• File System: Presence of unexpected TIFF or JPEG files with anomalous DHT segments (e.g., bits[1]=3 with only 2-entry table allocation) in directories processed by LibRaw-linked applications; file names such as poc_lljpeg_hufftable.tif or similar.
• Process: Unexpected crashes or core dumps from applications using LibRaw (e.g., image viewers, RAW converters, photo processing daemons); AddressSanitizer output referencing HuffTable::initval in decompressors/losslessjpeg.cpp:374.
• Logs: Application crash logs or error reports referencing LIBRAW_EXCEPTION_IO_CORRUPT, heap-buffer-overflow errors, or segmentation faults originating from LibRaw_LjpegDecompressor::initialize() or LibRaw::unpack(); system logs showing abnormal termination of image processing services.

Upgrade LibRaw to version 0.22.1, which includes the fix (commit a6734e867b19d75367c05f872ac26322464e3995, also referenced as TALOS-2026-2330) that adds bounds checks inside the write loop and validates the pos index against the 256-entry limit (LibRaw Commit, GitHub Advisory). As a workaround where upgrading is not immediately possible, restrict or sandbox applications that process untrusted JPEG/TIFF files using LibRaw, and implement input validation to reject files with malformed DHT segments before they reach LibRaw. Downstream packages (e.g., Fedora packages for siril and vips) have also issued updates incorporating the fix.

The vulnerability was reported via the LibRaw GitHub issue tracker by researcher biniamf on March 15, 2026, with a detailed technical write-up and PoC (LibRaw Issue #794). The LibRaw maintainer committed a fix labeled as addressing TALOS-2026-2330, indicating Cisco Talos involvement in coordinated disclosure (LibRaw Commit). Red Hat tracked the issue via Bugzilla and published a security advisory, and downstream Linux distributions including Fedora issued updates for affected packages such as siril and vips. Community reaction has been measured given the medium/low severity rating and the denial-of-service-only impact.