CVE-2025-43962: Critical severity Libraw Libraw vulnerability
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librawto a version that resolves this vulnerability.Fixed in 0.20.2-1+deb11u2Fixed in 0.21.4-2 - Upgrade
Upgrade
LibRawto a version that resolves this vulnerability.Fixed in 0.21.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43962?
CVE-2025-43962 has been classified as a high-severity vulnerability due to its potential for out-of-bounds reads.
How do I fix CVE-2025-43962?
To resolve CVE-2025-43962, update LibRaw to version 0.21.4 or later.
What causes the vulnerability in CVE-2025-43962?
CVE-2025-43962 is caused by out-of-bounds reads in the phase_one_correct function due to improper handling of large w0 or w1 values.
Which versions are affected by CVE-2025-43962?
CVE-2025-43962 affects all LibRaw versions prior to 0.21.4.
What should I do if I cannot update LibRaw to fix CVE-2025-43962?
If you cannot update LibRaw, consider implementing mitigations to minimize the risk of exploitation.