Skip to main content

LibRaw CVE-2026-88387

| EUVDEUVD-2026-86473 MEDIUM
Incorrect Conversion between Numeric Types (CWE-681)
2026-09-24 mitre GHSA-6cg8-27q5-77wx
Denial Of Service Red Hat N A Suse Libraw
5.5
CVSS 3.1 · Vendor: mitre
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft TIFF/DNG with out-of-range NewSubfileType tag
  2. Delivery
    Deliver file to victim or image-processing service
  3. Exploit
    Victim opens file in LibRaw 0.22.0
  4. Execution
    Unvalidated narrowing conversion in parse_tiff_ifd()
  5. Impact
    Undefined behavior terminates process (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-681
Exploitation Conditions

Exploitation requires the victim application to parse an attacker-supplied RAW, TIFF, or DNG file with LibRaw 0.22.0 via a code path reaching LibRaw::parse_tiff_ifd() (the standard metadata parse on file open). The crafted file must set TIFF tag 0x00fe (NewSubfileType) to a value outside signed-int range. Limiting factors: user interaction is required (UI:R) - a victim or an automated service must open/process the file; there is no privilege requirement (PR:N) but also no network self-propagation, and impact is confined to availability (process crash) with no data exposure or code execution. Any default LibRaw 0.22.0 consumer that ingests untrusted images is affected; no special non-default configuration is needed.
Impact

All signals converge on a low-to-moderate, availability-only issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, user-interaction-gated denial of service with no confidentiality or integrity impact - the attacker must get a victim to open a crafted RAW/TIFF/DNG file. EPSS is very low (0.15%, 4th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. A public reproducer/regression harness ships in the fixing pull request (PR #853) and the underlying report is public (issue #844), so exploit-relevant code exists, but this is a crash primitive, not code execution. No SSVC decision data was provided in the input. Bottom line: this is a genuine but modest-impact bug - a parser crash triggered by opening a malicious image - appropriately rated moderate; it is not a high-priority remote RCE. Note the AV:L classification: exploitation is 'local' only in the CVSS sense that a file must be delivered and opened; the malicious file itself can originate remotely (email, download, web upload pipeline), which defenders should weigh for any service that auto-processes untrusted images with LibRaw.
Exploit ScenarioDerived

An attacker crafts a TIFF/DNG/RAW file whose NewSubfileType tag (0x00fe) holds a value outside signed-int range and delivers it to a victim (or an automated image-processing service) that uses LibRaw 0.22.0. When the file is opened, LibRaw::parse_tiff_ifd() narrows the value to int without validation, triggering undefined behavior and crashing the process. A public reproducer exists in the fix PR (#853), demonstrating the exact crafted-buffer parsing behavior.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Denial of service in LibRaw 0.22.0: opening a crafted RAW, TIFF or DNG file whose TIFF tag 0x00fe (NewSubfileType) carries a value outside signed-int range drives an unchecked narrowing conversion in LibRaw::parse_tiff_ifd(), triggering undefined behavior that terminates the process. The issue is availability-only (CVSS 3.1 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and requires user interaction - a victim or an automated pipeline must open the malicious file - with no privilege requirement, no data exposure and no code execution. There is no evidence of active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile), although the upstream fix PR contains a regression harness with a minimal crafted TIFF that reproduces the out-of-range value, so a public crash reproducer exists.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit b41cbbd61951783e0440590dae55411a16185bdf from PR #853 (https://github.com/LibRaw/LibRaw/pull/853), which widens tiff_ifd_t::newsubfiletype to unsigned int and replaces the narrowing int(getreal(type)) conversion with the raw get4() read; distribution and downstream vendors should cherry-pick or backport this change rather than waiting for a tagged LibRaw release, and re-link affected applications against the rebuilt library. Until patched, isolate the parsing path: run RAW/TIFF/DNG conversion and metadata extraction in a separate, unprivileged, sandboxed process (container, seccomp/AppArmor confinement, or a worker with memory and CPU limits) so the abort cannot take down a long-running service, and treat a crash as evidence rather than letting the same process continue - the trade-off is added latency and operational complexity. Additional compensating controls include rejecting or quarantining image uploads that fail pre-validation with a memory-safe TIFF parser, disabling automatic thumbnail/metadata generation for untrusted files in batch pipelines, and restricting which users or systems may submit RAW files; each of these reduces functionality (no previews, slower ingestion, blocked legitimate RAW workflows) but prevents the malformed NewSubfileType tag from ever reaching the vulnerable parser. No network-exposed service is fixed by port or endpoint filtering here, since the vector is local file ingestion (AV:L/UI:R), so the practical priority is patching plus process-level crash isolation.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Root cause is CWE-681 (Incorrect Conversion between Numeric Types) in LibRaw's TIFF Image File Directory parser. TIFF tag 0x00fe (NewSubfileType) is a metadata flag whose bits mark reduced-resolution images, single-page files and transparency masks; LibRaw stores it in the tiff_ifd_t structure as a signed int. In the vulnerable code the value was assigned as int(getreal(type)), i.e. the raw tag value was routed through a floating-point helper and then converted to int with no range check, so an attacker-controlled value outside signed-int range yields undefined behavior - in practice an abort/termination of the process during the standard metadata parse performed on file open. The upstream fix (PR #853) changes the struct member from int to unsigned int and replaces the conversion with the raw 32-bit read get4(), eliminating the lossy/out-of-range float-to-int narrowing entirely and preserving the full unsigned value (the accompanying regression test asserts that a crafted file yields 0xe3000001). No CPE identifiers were populated for this record (CPE strings are n/a), so product scoping relies on the LibRaw 0.22.0 version identifier and the vendor references.

Know when Libraw gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

A crafted file must be opened by the victim, so AV:L and UI:R; no auth needed (PR:N); undefined behavior crashes only the parsing process (A:H, C:N/I:N, S:U).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
CVSS changed
Sep 29, 2026 - 03:22 NVD
5.5 (MEDIUM)
CVE Published
Sep 24, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.

Threat Intelligence Overview

EPSS Score
0.2%
Top 96% exploitable
Prevalence
Medium
popular RAW-image library embedded in many photo/imaging applications and pipelines
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libraw

View all
CVE-2018-20337 HIGH POC
8.8 Dec 21

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Rated high

CVE-2013-2126 HIGH POC
7.5 Aug 14

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow cont
CVE-2020-24889 HIGH POC
7.8 Sep 16

A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp

CVE-2013-2127 HIGH POC
7.5 Aug 14

Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a de
CVE-2026-21413 CRITICAL
9.8 Apr 07

Heap-based buffer overflow in LibRaw's lossless JPEG processing (commits 0b56545 and d20315b) allows unauthenticated rem
CVE-2023-1729 MEDIUM POC
6.5 May 15

A flaw was found in LibRaw. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenticat
CVE-2020-15365 MEDIUM POC
6.5 Jun 28

LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomNam
CVE-2018-20365 MEDIUM POC
6.5 Dec 22

LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerabi
CVE-2018-20364 MEDIUM POC
6.5 Dec 22

LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Rated medium severity (CVSS 6.5),

CVE-2018-20363 MEDIUM POC
6.5 Dec 22

LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Rated medium severity (CVSS 6.5), t
CVE-2017-14265 CRITICAL
9.8 Sep 11

A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3.
CVE-2017-6886 CRITICAL
9.8 May 16

An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be expl

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

View all
CVE-2017-7308 HIGH POC
7.8
CVE-2016-3074 CRITICAL POC
9.8
CVE-2021-38187 CRITICAL POC
9.8
CVE-2022-34169 HIGH POC
7.5
CVE-2021-27219 HIGH POC
7.5
CVE-2022-27882 HIGH POC
7.5
CVE-2020-6582 HIGH POC
7.5
CVE-2019-16200 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-88387 REF https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf REF https://github.com/LibRaw/LibRaw/issues/844 REF https://github.com/LibRaw/LibRaw/pull/853

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy