Executive brief
LibRaw is a software library used by many applications to process RAW image files from digital cameras. A vulnerability was found that allows a specially crafted Nikon image file to cause the software to read memory outside of its intended boundaries. This could lead to application crashes or service disruptions when processing malicious images.
Technical details
An out-of-bounds read vulnerability exists in LibRaw up to version 0.22.0 within the LibRaw::nikon_load_padded_packed_raw function in src/decoders/decoders_libraw.cpp. The root cause is a lack of validation between the load_flags metadata (used for buffer allocation) and the raw_width metadata (used to define the loop bounds for processing). An attacker can provide a crafted TIFF/NEF file where the width-derived access pattern exceeds the allocated buffer size, resulting in a heap-buffer-overflow. This can be exploited remotely if an application uses LibRaw to process untrusted user-supplied images. The issue is mitigated in version 0.22.1.
Affected products
- LibRaw LibRaw up to 0.22.0
Timeline
- 2026-03-16: disclosed: Issue reported on GitHub
- 2026-04-02: advisory: NVD publication date
- 2026-04-06: patched: Version 0.22.1 released
References
- https://github.com/LibRaw/LibRaw/
- https://github.com/LibRaw/LibRaw/commit/b8397cd45657b84e88bd1202528d1764265f185c
- https://github.com/LibRaw/LibRaw/issues/795
- https://github.com/LibRaw/LibRaw/issues/795
- https://github.com/LibRaw/LibRaw/releases/tag/0.22.1
- https://github.com/biniamf/pocs/tree/main/libraw_nikonpadded
- https://vuldb.com/submit/781223