{"id":"ECHO-ddb8-c818-edca","upstream":["CVE-2026-5318"],"severity":[],"modified":"2026-05-04T12:45:02.377Z","affected":[{"package":{"ecosystem":"Echo","name":"libraw"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.4"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-5318"}],"withdrawn":"2026-05-04T12:45:02.377Z","summary":"Vulnerable code is not present in libraw 0.21.4 (the version shipped in\nDebian trixie). The CVE describes a heap out-of-bounds write in\nHuffTable::initval (src/decompressors/losslessjpeg.cpp), reachable via\nLibRaw::sony_ycbcr_load_raw -> LibRaw_LjpegDecompressor::initialize ->\nHuffTable::initval. None of those symbols exist in 0.21.4: the\nsrc/decompressors/ directory, the LibRaw_LjpegDecompressor class, and\nthe sony_ycbcr_load_raw entry point were all introduced together in\nlibraw 0.22.0.\n\nEmpirically confirmed by running the public PoC from\nhttps://github.com/biniamf/pocs/tree/main/libraw_lljpeg against an ASan\nbuild of unpatched libraw 0.21.4: the file is rejected at open with\n\"Unsupported file format or not RAW file\"; the same PoC reproduces the\nheap-buffer-overflow in 0.22.0 with the stack trace from the Talos\nreport.\n"}