Audit LibRaw Security Update Status for CVE-2026-20884 on Linux

What the LibRaw CVE-2026-20884 audit Worklet does

This Automox Worklet™ checks whether the LibRaw package on a Linux endpoint is older than the distribution's security update for CVE-2026-20884. The flaw, tracked in Talos advisory TALOS-2026-2364, is an integer overflow in LibRaw's deflate_dng_load_raw() function. When an application processes a crafted Digital Negative (DNG) file, the flaw can lead to a heap buffer overflow. LibRaw 0.22.1 fixes it upstream.

The Worklet is report-only, so you can run it on servers and workstations alongside your patch policy. For each endpoint that needs the update, the report gives you the install command.

Why audit LibRaw update status across Linux endpoints

Applications that decode camera RAW files load LibRaw as a shared library. A scanner finding for CVE-2026-20884 often names the library, not the application you installed. Running the Worklet from one Automox policy gives you a fleet-wide list of endpoints that still need the distribution's update. That list can serve as evidence for the identify-and-report part of NIST SP 800-53 SI-2 (Flaw Remediation) and PCI DSS Requirement 6.3.

Talos scores the flaw 8.1 (High). Red Hat rates it Moderate. At LibRaw's default max_raw_memory_mb of 2,048 MB, the flaw isn't exploitable. Only applications that raise that limit to roughly 11 GB or more are exposed.

Fedora and openSUSE Tumbleweed ship LibRaw 0.22.1, while Debian, Ubuntu, SUSE Linux Enterprise, and openSUSE Leap backport the fix into older package versions. No single version number tells you an endpoint is patched. Debian 12 carries the fix in 0.20.2-2.1+deb12u2, Ubuntu 24.04 in 0.21.2-2.1ubuntu0.24.04.2, and Fedora 44 in 0.22.1-1.fc44.

How the LibRaw update audit works

1. Evaluation phase: Queries the package database for packages built from the LibRaw source package. If dpkg-query is present, it runs dpkg-query -W and keeps installed packages whose ${source:Package} field is libraw. Otherwise it runs rpm -qa and keeps packages whose %{SOURCERPM} starts with LibRaw- or libraw- followed by a version number. Matching on the source package excludes unrelated names such as libraw1394.

   The Worklet reads ID and VERSION_ID from /etc/os-release and looks up that release in its fixed-version table. It compares versions with dpkg --compare-versions for Debian packages and with rpm's version comparison for RPM packages. That way, a backport suffix such as +deb12u2 sorts the way the package manager sorts it.

   When an installed LibRaw package is older than the vendor's fixed version for the release, the Worklet exits 1 with a NON-COMPLIANT result. That marks the endpoint non-compliant and schedules remediation. Every other outcome exits 0 without scheduling remediation.

2. Remediation phase: Writes a report to the Activity Log and makes no changes. If LibRaw is installed, the report lists the packages, the distribution release, and the fixed version when the vendor has one. The remediation script runs the checks itself rather than relying on evaluation, so it's safe to run directly with FixNow.

   Each completed run ends with a RESULT line, and the labels differ by phase:

   • LibRaw isn't installed: NOT APPLICABLE in the report, COMPLIANT (not applicable) in evaluation

   • Every installed LibRaw package includes the fix: UP TO DATE in the report, COMPLIANT in evaluation

   • An installed package is older than the fixed version: UPDATE REQUIRED in the report, NON-COMPLIANT in evaluation

   • The vendor lists the release as not affected: NOT AFFECTED in the report, COMPLIANT (not affected) in evaluation

   • The vendor has no fix for the release: NO VENDOR FIX in both

   • The release isn't in the fixed-version table, or a version comparison failed: INDETERMINATE in both

   • The package database can't be read: INDETERMINATE in evaluation, and no RESULT line in the report

   When an update is required, the report adds an ACTION REQUIRED note. The note names the fixed version and points you to an Automox patch policy or the package manager. The report then gives the install command for the endpoint's package manager:

   • APT: apt-get update, then apt-get install --only-upgrade -y with the installed LibRaw package names

   • DNF: dnf upgrade -y with the same package names

   • Zypper: zypper --non-interactive patch --cve=CVE-2026-20884

   If none of the three is present, the report includes the note without a command. A NO VENDOR FIX report has no install command. It notes that the flaw isn't exploitable at LibRaw's default max_raw_memory_mb. It also asks you to review any application that raises that limit when processing untrusted RAW files.

   For a release that isn't in the table, the INDETERMINATE report points you to your distribution's security tracker for CVE-2026-20884. When a version comparison fails, the report asks you to verify the LibRaw version manually.

   The remediation script exits 0 whenever it produces the report, including when an update is required. It exits 1 if it can't read the package database, and the Activity Log shows the run as failed.

LibRaw audit requirements and supported releases

• Releases with a fixed LibRaw version in the table, as of September 23, 2026:

  • Debian 11, 12, and 13

  • Ubuntu 22.04, 24.04, and 26.04

  • Fedora 44 and 45

  • SLES and SLES for SAP 15 SP4 with Long Term Service Pack Support (LTSS)

  • SUSE Linux Enterprise Desktop (SLED) 15 SP4, which the Worklet checks against the SLES 15 SP4 LTSS fixed version, 0.20.2-150400.3.21.1

  • SLES, SLED, and SLES for SAP 15 SP7

  • SLES and SLES for SAP 16.0, openSUSE Leap 16.0, and openSUSE Tumbleweed

• RHEL 9, AlmaLinux 9, Rocky Linux 9, and CentOS Stream 9, which Red Hat lists as not affected

• RHEL 7 and 8, AlmaLinux 8, Rocky Linux 8, CentOS 7 and 8, and Ubuntu 18.04 and 20.04, which had no vendor fix as of that date

• Other releases, which the Worklet reports as INDETERMINATE

• dpkg-query or rpm to read the package database

• RPM version comparison through rpm.vercmp, with a fallback to the python3 rpm module

• The Automox agent's standard privileges. The Worklet only reads package and release data and makes no changes

• No variables, payload files, or network access

Expected audit results after a policy run

Outdated endpoints stay non-compliant on every run until you install the update. After you install it, the next evaluation reports compliant. A FixNow run reports UP TO DATE. You'll need to restart any application that loads LibRaw so it picks up the patched library.

A scheduled policy runs remediation only on non-compliant endpoints, so the Activity Log report covers just the endpoints that need the update. To see the RESULT line on other endpoints, including those that report NO VENDOR FIX or INDETERMINATE, run the Worklet with FixNow. You can also open the endpoint's details page in the Automox console and read the policy test entry in its logs.