Libraw - vulnerabilities (CVEs)

66 CVEs in 2 products, 1 in the last 30 days, newest from 2026-10-15.

Products

Libraw - 64 CVEs
Libraw-demosaic-pack-gpl2 - 2 CVEs

Newest CVEs of Libraw

CVE-2026-111272 - CVSS 6.8 (medium), 2026-10-15: LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer.…
CVE-2026-24660 - CVSS 9.8 (critical), 2026-04-07: A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead…
CVE-2026-24450 - CVSS 9.8 (critical), 2026-04-07: An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can…
CVE-2026-20911 - CVSS 9.8 (critical), 2026-04-07: A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted…
CVE-2026-20889 - CVSS 9.8 (critical), 2026-04-07: A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead…
CVE-2026-20884 - CVSS 9.8 (critical), 2026-04-07: An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a…
CVE-2026-21413 - CVSS 9.8 (critical), 2026-04-07: A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted…
CVE-2026-5342 - CVSS 6.9 (medium), 2026-04-02: A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of…
CVE-2026-5318 - CVSS 5.3 (medium), 2026-04-02: A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the…
CVE-2025-43963 - CVSS 9.1 (critical), 2025-04-21: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in…
CVE-2025-43962 - CVSS 9.1 (critical), 2025-04-21: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or…
CVE-2025-43964 - CVSS 9.8 (critical), 2025-04-21: In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.
CVE-2025-43961 - CVSS 9.1 (critical), 2025-04-21: In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
CVE-2020-22628 - CVSS 6.5 (medium), 2023-08-22: Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspect_ratio.cpp.
CVE-2023-1729 - CVSS 6.5 (medium), 2023-05-15: A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.
CVE-2021-32142 - CVSS 7.8 (high), 2023-02-17: Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in…
CVE-2020-35535 - CVSS 5.5 (medium), 2022-09-01: In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
CVE-2020-35531 - CVSS 5.5 (medium), 2022-09-01: In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an…
CVE-2020-35534 - CVSS 5.5 (medium), 2022-09-01: In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
CVE-2020-35530 - CVSS 5.5 (medium), 2022-09-01: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a…
CVE-2020-35533 - CVSS 5.5 (medium), 2022-09-01: In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from…
CVE-2020-35532 - CVSS 5.5 (medium), 2022-09-01: In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered…
CVE-2020-24870 - CVSS 8.8 (high), 2021-06-02: Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
CVE-2020-24890 - CVSS 5.5 (medium), 2020-09-16: libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code…
CVE-2020-24889 - CVSS 7.8 (high), 2020-09-16: A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent…
CVE-2020-15503 - CVSS 7.5 (high), 2020-07-02: LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp.…
CVE-2020-15365 - CVSS 6.5 (medium), 2020-06-28: LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.
CVE-2015-8367 - CVSS 9.8 (critical), 2020-01-14: The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object…
CVE-2015-8366 - CVSS 9.8 (critical), 2020-01-14: Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute…
CVE-2018-5818 - CVSS 7.5 (high), 2019-02-20: An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.