CVE-2025-43963: Critical severity Libraw Libraw vulnerability

Q: What is the severity of CVE-2025-43963?

CVE-2025-43963 is considered to have a critical severity due to potential out-of-bounds access allowing exploitation.

Q: How do I fix CVE-2025-43963?

To fix CVE-2025-43963, upgrade LibRaw to version 0.21.4 or later to mitigate the vulnerability.

Q: What type of vulnerability is CVE-2025-43963?

CVE-2025-43963 is an out-of-bounds write vulnerability in the phase_one_correct function of LibRaw.

Q: Which versions of LibRaw are affected by CVE-2025-43963?

LibRaw versions before 0.21.4 are affected by CVE-2025-43963.

Q: What are the consequences of exploiting CVE-2025-43963?

Exploitation of CVE-2025-43963 could lead to application crashes, data corruption, or arbitrary code execution.

Published Apr 20, 2025

Updated

In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp allows out-of-buffer access because splitcol and splitrow values are not checked in 0x041f tag processing.

Affected Software

3 affected componentsFixes available

Libraw Libraw<0.21.4

debian/libraw<=0.20.2-1+deb11u1, <=0.20.2-2.1

0.20.2-1+deb11u20.21.4-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libraw to a version that resolves this vulnerability.
Fixed in 0.20.2-1+deb11u2Fixed in 0.21.4-2
Upgrade
Upgrade LibRaw to a version that resolves this vulnerability.
Fixed in 0.21.4

Event History

Apr 20, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Apr 21, 2025

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-43963?

CVE-2025-43963 is considered to have a critical severity due to potential out-of-bounds access allowing exploitation.

How do I fix CVE-2025-43963?