A critical buffer overflow vulnerability in LibRaw 0.21 may allow remote attackers to achieve arbitrary code execution via malicious image files.

The software is susceptible to a buffer overflow in the stretch() function (src/libraw_cxx.cpp) and the fuji_rotate() function (src/decoders/fuji.cpp). This allows an unauthenticated attacker to trigger a memory safety violation.

With a CVSS score of 8.8, this vulnerability poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the application processing the image, potentially leading to full system compromise or unauthorized access to sensitive data processed by the library.

Immediate Action: Consult the vendor advisory at https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51235 to determine if a patch or configuration workaround is available for your specific deployment.

Proactive Monitoring: Monitor application logs for unexpected crashes or error patterns related to image processing functions.

Compensating Controls: Implement strict input validation and sandboxing for any service that utilizes LibRaw to process untrusted image files.

Public Exploit Available: No

Given the potential for arbitrary code execution, organizations should prioritize evaluating their exposure to LibRaw 0.21. Until a formal patch is applied, isolate image processing tasks to low-privilege environments to minimize the impact of a potential compromise.