Bug 2456557

Summary:	CVE-2026-20884 LibRaw: LibRaw: Arbitrary code execution via integer overflow in deflate_dng_load_raw [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Marco Benatto <mbenatto>
Component:	LibRaw	Assignee:	Gwyn Ciesla <gwync>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	44	CC:	dchen, gwync, hobbes1069, ngompa13, sipoyare
Target Milestone:	---	Keywords:	Reopened, Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	AcceptedFreezeException {"flaws": ["acfd00f8-34f9-49c8-86c1-f154d0740684"]}
Fixed In Version:	LibRaw-0.22.1-1.fc45 LibRaw-0.22.1-1.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-04-13 21:06:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2455934, 2362360

Description Marco Benatto 2026-04-08 16:47:15 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Fedora Update System 2026-04-08 21:07:33 UTC

FEDORA-2026-ffba395f42 (deepin-image-viewer-5.8.2-21.fc45, dtk6gui-6.7.32-5.fc45, and 26 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-ffba395f42

Comment 2 Fedora Update System 2026-04-08 22:36:09 UTC

FEDORA-2026-ffba395f42 (deepin-image-viewer-5.8.2-21.fc45, dtk6gui-6.7.32-5.fc45, and 26 more) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 3 Fedora Update System 2026-04-08 23:11:36 UTC

FEDORA-2026-bef0050737 (deepin-image-viewer-5.8.2-21.fc44, dtk6gui-6.7.32-5.fc44, and 26 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-bef0050737

Comment 4 Fedora Update System 2026-04-09 01:39:25 UTC

FEDORA-2026-bef0050737 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-bef0050737`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-bef0050737

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Neal Gompa 2026-04-13 17:12:07 UTC

Opening and redirecting to F44 for FE process

Comment 6 Fedora Blocker Bugs Application 2026-04-13 17:12:24 UTC

Proposed as a Freeze Exception for 44-final by Fedora user ngompa using the blocker tracking app because:

 Fixes serious CVE for LibRaw

Comment 7 Lukas Ruzicka 2026-04-13 18:37:43 UTC

AGREED AcceptedFinalFreezeException

Discussed at the 2026-04-13 (blocker / freeze exception) review meeting:

This is accepted to fix a fairly significant (though only rated Moderate, so it's not a blocker) CVE in release-blocking images.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-04-13/f44-blocker-review.2026-04-13-16.00.log.txt

Comment 8 Fedora Update System 2026-04-13 21:06:31 UTC

FEDORA-2026-bef0050737 (deepin-image-viewer-5.8.2-21.fc44, dtk6gui-6.7.32-5.fc44, and 26 more) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.