A heap-based buffer overflow exists in LibRaw's x3f_thumb_loader functionality. A maliciously crafted image file can trigger an overflow that allows an attacker to execute arbitrary code within the context of the application that uses LibRaw. The flaw is classified under CWE-120 and CWE-190, indicating a vulnerability that involves improper memory handling and signed integer issues.

The vulnerability affects LibRaw version 0.22.0 and earlier releases that contain the same commit. Applications that use LibRaw to process X3F images, such as photo editors, imaging tools, and other software that imports this format, are vulnerable when handling files from untrusted sources.

The CVSS score of 9.8 marks this issue as critical, while the EPSS score of less than 1% points to a currently low probability of exploitation. The likely attack vector is local file processing; however, if an application that incorporates LibRaw accepts uploaded images over a network, remote exploitation becomes possible. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation is documented.