CVE-2026-111272: LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using LibRaw through 0.22.2 to decode Nikon NEF/TIFF images are exposed when they process attacker-supplied images.
What does exploitation require?
An attacker must provide a crafted Nikon NEF/TIFF containing a 5-byte ShotInfo tag that declares version 243. The affected application must decode that image, so user interaction is required.
What is the practical impact?
Processing the crafted image can cause the application to read past a short heap buffer and crash. The supplied CVSS vector indicates availability impact, with no confidentiality or integrity impact.