6.8
Medium
CVE-2026-111272 LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to…
Description
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LibRaw 0.22 | earliest → 0.22.2 | No fix stated |
References
- hackmd.io hackmd.io
- github.com github.com
- github.com github.com
- VulnCheck Advisory: LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of LibRaw
The 13 CVEs of LibRaw →
CVE-2026-20911
A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and…
9.8
Critical
CVE-2026-21413
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
9.8
Critical
CVE-2026-20889
A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b
9.8
Critical
CVE-2026-24660
A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b
8.1
High