ALAS2-2026-3258

Amazon Linux 2 Security Advisory: ALAS2-2026-3258
Advisory Released Date: 2026-04-30
Advisory Updated Date: 2026-04-30
Severity: Important
Issue Overview:

An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2026-20884)

A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2026-24660)


Affected Packages:

LibRaw


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update LibRaw or yum update --advisory ALAS2-2026-3258 to update your system.

New Packages:
aarch64:
    LibRaw-0.19.4-1.amzn2.0.8.aarch64
    LibRaw-devel-0.19.4-1.amzn2.0.8.aarch64
    LibRaw-static-0.19.4-1.amzn2.0.8.aarch64
    LibRaw-debuginfo-0.19.4-1.amzn2.0.8.aarch64

i686:
    LibRaw-0.19.4-1.amzn2.0.8.i686
    LibRaw-devel-0.19.4-1.amzn2.0.8.i686
    LibRaw-static-0.19.4-1.amzn2.0.8.i686
    LibRaw-debuginfo-0.19.4-1.amzn2.0.8.i686

src:
    LibRaw-0.19.4-1.amzn2.0.8.src

x86_64:
    LibRaw-0.19.4-1.amzn2.0.8.x86_64
    LibRaw-devel-0.19.4-1.amzn2.0.8.x86_64
    LibRaw-static-0.19.4-1.amzn2.0.8.x86_64
    LibRaw-debuginfo-0.19.4-1.amzn2.0.8.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-20884, CVE-2026-24660

Mitre: CVE-2026-20884, CVE-2026-24660