Which versions of RapidRAW are affected by EUVD-2026-51330?

RapidRAW versions prior to 1.6.0 contain a credential theft vulnerability that captures Windows NTLMv2 domain credentials when users open malicious preset files.. A patch is available.

How to fix or mitigate EUVD-2026-51330?

Within 24 hours, identify all systems running RapidRAW versions prior to 1.6.0 and notify users to avoid opening preset files from untrusted sources. Within 7 days, deploy RapidRAW 1.6.0 or later to all affected systems. Within 30 days, review Windows authentication logs for unusual logon activity on systems that accessed preset files during the exposure window, audit for evidence of lateral movement, and force password resets for any accounts showing compromise indicators.

RapidRAW EUVD-2026-51330

Q: What is the CVSS score of EUVD-2026-51330?

EUVD-2026-51330 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-64816 HIGH

External Control of File Name or Path (CWE-73)

2026-07-30 VulnCheck

GHSA-2jwx-hj3p-pj84

Information Disclosure Microsoft Rapidraw

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote malicious preset with no privileges but mandatory victim interaction (UI:R); leaks NTLMv2 credentials so C:H, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 30, 2026 - 22:15 vuln.today

Analysis Generated

Jul 30, 2026 - 22:15 vuln.today

CVE Published

Jul 30, 2026 - 21:32 cve.org

HIGH 7.1

DescriptionCVE.org

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels.

AnalysisAI

Sensitive information disclosure in RapidRAW before 1.6.0 (an open-source cross-platform RAW photo editor) allows a remote attacker to steal a Windows victim's NTLMv2 credentials by embedding a UNC path in the lutPath field of a preset file. Because RapidRAW passes lutPath directly to File::open() without validation, opening the poisoned preset forces an outbound SMB authentication to an attacker-controlled host. There is no public exploit identified at time of analysis, but the technique (UNC-path credential coercion) is well understood and trivially reproducible, so real-world abuse is realistic once a malicious preset is shared.

Technical ContextAI

The root cause is CWE-73 (External Control of File Name or Path): the lutPath value from an untrusted preset file is used unsanitized in a filesystem open call within lut_processing.rs. LUT (Look-Up Table) files are legitimate color-grading assets referenced by presets, but on Windows the File::open() call transparently resolves UNC syntax (\\attacker-host\share\file), causing the SMB/CIFS client to initiate an SMB session and perform NTLMv2 authentication using the logged-in user's cached credentials. The captured NTLMv2 challenge-response can be cracked offline or relayed to other services. Affected component is the RapidRAW application by developer CyberTimon (CPE cpe:2.3:a:cybertimon:rapidraw:*:*:*:*:*:*:*:*); the flaw is Windows-specific because UNC path handling and automatic NTLM authentication are Windows behaviors.

RemediationAI

Vendor-released patch: RapidRAW v1.6.0 - upgrade to 1.6.0 or later, which is the primary and complete fix (release: https://github.com/CyberTimon/RapidRAW/releases/tag/v1.6.0; fix commit: https://github.com/CyberTimon/RapidRAW/commit/83852f36ba4a260be). Until upgrading, avoid opening the Community tab (which auto-fetches remote presets) and do not import preset files received via Discord, forums, or other untrusted channels, since both are exploitation vectors. As a network compensating control on Windows, block outbound SMB (TCP 445 and 137-139) at the host/perimeter firewall to prevent credential-leaking connections to external hosts - with the trade-off that legitimate access to external file shares over SMB will also break; additionally, enabling NTLM outbound restrictions or requiring SMB signing reduces relay risk. See VulnCheck's advisory for details: https://www.vulncheck.com/advisories/rapidraw-ntlmv2-credential-leak-via-unc-path-in-lutpath.