LibRaw CVE-2026-111272

Exploitation requires the victim to decode a crafted Nikon NEF/TIFF image containing a malformed 5-byte ShotInfo makernote tag declaring version 243, using an application or service built on LibRaw version 0.22.2 or earlier with Nikon makernote parsing active. Limiting factors: the attacker cannot trigger it remotely on its own - a user or automated pipeline must open/process the attacker-supplied file (UI:P, AV:L), the file must specifically target the Nikon ShotInfo code path, and the outcome is confined to crashing the process (availability only); there is no confirmed memory disclosure, code execution, or privilege gain.

This is a moderate-risk availability flaw, not a top-priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, score 6.8) tells a consistent story: low attack complexity and no privileges needed, but the attacker must get a victim to passively process a crafted file (UI:P) and the only impact is availability (VA:H) - a crash - with zero confidentiality or integrity impact (VC:N/VI:N). Notably, the CWE (CWE-125 out-of-bounds read) and the 'Information Disclosure' tag suggest data leakage, but the CVSS explicitly sets VC:N, meaning the realistic outcome is a denial-of-service crash of the decoding application, not memory disclosure - this apparent conflict should be noted: the OOB read terminates the process rather than returning readable data to the attacker. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. No explicit POC flag was supplied, though a detailed public technical writeup (hackmd) and the exact vulnerable source lines on GitHub are referenced, which materially lowers the barrier to building a trigger. Overall: a real, easily-triggered DoS in a popular library, but bounded impact (crash only) and no confirmed exploitation keep this below critical priority - patch on a normal cadence.

An attacker crafts a malicious Nikon NEF/TIFF image embedding a 5-byte ShotInfo makernote tag that falsely declares version 243, then delivers it to a victim (e.g., via email, upload, or a shared photo) who opens it in any application or service using LibRaw ≤0.22.2. When LibRaw::parseNikonMakernote() reads past the short ShotInfo buffer, the application crashes (denial of service). A public technical writeup detailing the exact offending code path exists, making a working trigger file straightforward to reproduce.