CVE-2026-88387: Libraw Libraw vulnerability
LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parsetiffifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using LibRaw 0.22.0 to process attacker-controlled or otherwise untrusted RAW, TIFF, or DNG files are exposed.
What must an attacker do to trigger the issue?
The attacker must cause the application to parse a specially crafted RAW, TIFF, or DNG file containing an attacker-controlled NewSubfileType value that falls outside the signed int range.
What is the observed impact of successful exploitation?
The out-of-range numeric conversion causes undefined behavior that results in process termination and denial of service.