CVE-2026-5342: 
NixOS vulnerability analysis and mitigation

CVE-2026-5342 is a heap out-of-bounds read vulnerability in LibRaw's nikon_load_padded_packed_raw() function, affecting all versions up to and including 0.22.0. The flaw resides in src/decoders/decoders_libraw.cpp and is triggered when processing crafted TIFF/NEF image files with inconsistent load_flags and raw_width metadata values. It was discovered and reported on March 16, 2026, and publicly disclosed on April 2, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper restriction of memory buffer operations (CWE-119 / CWE-125): the function allocates a row buffer sized from the load_flags metadata field, but the inner loop iterates raw_width / 2 times, accessing buf[icol*3], buf[icol*3+1], and buf[icol*3+2] — requiring (raw_width/2) * 3 bytes. No validation enforces that load_flags >= (raw_width / 2) * 3, so a crafted TIFF/NEF file with a small load_flags value and a large raw_width causes a heap buffer over-read. The attack is remotely exploitable with no authentication or user interaction required beyond supplying a malicious image file to an application using LibRaw. The fix (commit b8397cd) replaces the load_flags-based buffer sizing with a computed bytesperrow derived directly from raw_width, eliminating the mismatch (GitHub Issue #795, Fix Commit, PoC Repo).

Successful exploitation causes a heap buffer over-read, which can crash the LibRaw-based application, resulting in a denial of service. The CVSS scoring reflects no confidentiality or integrity impact — the primary consequence is availability loss (application crash/abort). Applications that process user-supplied or remotely fetched RAW image files (e.g., image viewers, converters, web services accepting NEF/TIFF uploads) are at risk of being crashed by a single malicious file (GitHub Advisory, GitHub Issue #795).

A public proof-of-concept exploit is available, consisting of a crafted TIFF file (poc_nikonpadded_oob.tif) and build/execution instructions that reproduce the heap-buffer-overflow with AddressSanitizer output (PoC Repo). The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.045%, indicating low probability of active exploitation in the near term (GitHub Advisory).

1. Craft a malicious TIFF/NEF file: Create a TIFF/NEF file with inconsistent metadata — set load_flags to a value between 2000 and 64000 (e.g., 3040) and set raw_width to a value where (raw_width/2) * 3 exceeds load_flags (e.g., raw_width = 2034 requires 3051 bytes but load_flags = 3040). The reference PoC file poc_nikonpadded_oob.tif demonstrates this (PoC Repo).
2. Deliver the file to the target: Submit the crafted file to any application or service that uses LibRaw ≤ 0.22.0 to process TIFF/NEF images — this could be via file upload, email attachment, or a shared directory.
3. Trigger image parsing: The target application calls LibRaw::unpack(), which dispatches to LibRaw::nikon_load_padded_packed_raw() for Nikon padded packed RAW files.
4. Trigger out-of-bounds read: The function allocates a buffer of load_flags bytes, then the inner loop reads beyond the buffer end at buf[icol*3+2] when icol exceeds the buffer capacity, causing a heap-buffer-overflow read.
5. Achieve denial of service: The application crashes (aborts) due to the memory safety violation, confirmed by AddressSanitizer output showing heap-buffer-overflow in LibRaw::nikon_load_padded_packed_raw() (GitHub Issue #795).

• File System: Presence of crafted TIFF/NEF files with anomalous metadata (very small load_flags relative to raw_width) in upload directories or temporary processing folders.
• Process: Unexpected crashes or aborts of LibRaw-based applications (e.g., image viewers, converters) when processing TIFF/NEF files; core dump files generated by the LibRaw process.
• Logs: Application error logs showing LIBRAW_EXCEPTION_IO_CORRUPT or abnormal termination signals (SIGABRT, SIGSEGV) during RAW image processing; AddressSanitizer output referencing nikon_load_padded_packed_raw if instrumented builds are in use.
• Network: Repeated submission of TIFF/NEF files to image processing endpoints from a single source IP, particularly files that consistently cause application crashes (GitHub Issue #795, PoC Repo).

Upgrade LibRaw to version 0.22.1, which includes the fix in commit b8397cd45657b84e88bd1202528d1764265f185c. The patch replaces the load_flags-based buffer allocation with a computed bytesperrow derived from raw_width, eliminating the mismatch. If immediate patching is not possible, restrict processing of untrusted or externally sourced TIFF/NEF image files and implement input validation on image file sources. Downstream distributions (Fedora, openSUSE, SUSE) have issued updated packages incorporating this fix (Fix Commit, GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported to the LibRaw project via GitHub Issue #795 by researcher biniamf on March 16, 2026, with a detailed technical write-up and PoC. The LibRaw maintainer responded promptly, and the fix was committed and released in version 0.22.1 by April 6, 2026. Red Hat tracked the issue via Bugzilla and the oss-security mailing list carried a disclosure post. Multiple Linux distributions (Fedora, openSUSE/SUSE) issued security advisories and updated packages. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking feeds (GitHub Issue #795, Red Hat Bugzilla).