ALAS2-2026-3255

Amazon Linux 2 Security Advisory: ALAS2-2026-3255
Advisory Released Date: 2026-04-30
Advisory Updated Date: 2026-04-30
Severity: Important
Issue Overview:

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2026-20889)

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2026-21413)


Affected Packages:

LibRaw


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update LibRaw or yum update --advisory ALAS2-2026-3255 to update your system.

New Packages:
aarch64:
    LibRaw-0.19.4-1.amzn2.0.7.aarch64
    LibRaw-devel-0.19.4-1.amzn2.0.7.aarch64
    LibRaw-static-0.19.4-1.amzn2.0.7.aarch64
    LibRaw-debuginfo-0.19.4-1.amzn2.0.7.aarch64

i686:
    LibRaw-0.19.4-1.amzn2.0.7.i686
    LibRaw-devel-0.19.4-1.amzn2.0.7.i686
    LibRaw-static-0.19.4-1.amzn2.0.7.i686
    LibRaw-debuginfo-0.19.4-1.amzn2.0.7.i686

src:
    LibRaw-0.19.4-1.amzn2.0.7.src

x86_64:
    LibRaw-0.19.4-1.amzn2.0.7.x86_64
    LibRaw-devel-0.19.4-1.amzn2.0.7.x86_64
    LibRaw-static-0.19.4-1.amzn2.0.7.x86_64
    LibRaw-debuginfo-0.19.4-1.amzn2.0.7.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-20889, CVE-2026-21413

Mitre: CVE-2026-20889, CVE-2026-21413