It was discovered that LibRaw could be made to read out of bounds. An attacker could possibly use this issue to cause applications using LibRaw to crash, resulting in a denial of service. (CVE-2025-43961, CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)
In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values.
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp allows out-of-buffer access because splitcol and splitrow values are not checked in 0x041f tag processing.
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspectratio.cpp.
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex() caused by a maliciously crafted file may lead to an application crash.
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::gets(char, int) in /src/libraw/src/librawdatastream.cpp.
https://github.com/LibRaw/LibRaw/commit/bc3aaf4223fdb70d52d470dae65c5a7923ea2a49 https://github.com/LibRaw/LibRaw/issues/400
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::gets(char, int) in /src/libraw/src/librawdatastream.cpp.
In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobecopypixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
In LibRaw, there is an out-of-bounds write vulnerability within the "newnode()" function (libraw\src\x3f\x3futilspatched.cpp) that can be triggered via a crafted X3F file.
In LibRaw, an out-of-bounds read vulnerability exists within the gethuffmandiff() function (libraw\src\x3f\x3futilspatched.cpp) when reading data from an image file.
In LibRaw, an out-of-bounds read vulnerability exists within the "simpledecoderow()" function (libraw\src\x3f\x3futilspatched.cpp) which can be triggered via an image with a large rowstride field.
A flaw was found in libraw. Stack buffer overflow in LibRaw::identifyprocessdngfields in identify.cpp may lead to local denial of service or local arbitrary code execution from a user crafted file.
References:
https://github.com/LibRaw/LibRaw/commit/4feaed4dea636cee4fee010f615881ccf76a096d https://github.com/LibRaw/LibRaw/issues/330
A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalizemodel.cpp may lead to context-dependent arbitrary code execution.
DISPUTED libraw 20.0 has a null pointer dereference vulnerability in parsetiffifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way.
Last updated 24 July 2024
LibRaw before 0.20-Beta3 has an out-of-bounds write in parseexif() in metadata\exifgps.cpp via an unrecognized AtomName and a zero value of tiffnifds.
Array index error in smaldecodesegment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.
The phaseonecorrect function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initialization.
An integer overflow error within the "parseqt()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime file.
An error within the "findgreen()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
An error within the "LibRaw::parseexif()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
A type confusion error within the "identify()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a division by zero.
An error within the "leafhdrloadraw()" function (internal/dcrawcommon.cpp) can be exploited to trigger a NULL pointer dereference.
References:
https://secuniaresearch.flexerasoftware.com/secuniaresearch/2018-03
A boundary error within the "quicktake100loadraw()" function (internal/dcrawcommon.cpp) can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.
References:
https://secuniaresearch.flexerasoftware.com/secuniaresearch/2018-03
An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in librawx3f.cpp and librawcxx.cpp.