A heap‑based buffer overflow exists within LibRaw’s HuffTable::initval routine, allowing a specially crafted image file to corrupt memory and potentially execute arbitrary code. The vulnerability is tied to two specific commits and can be triggered by providing a malicious file to LibRaw. Successful exploitation would compromise the integrity and confidentiality of any application or system that imports the file, and could lead to full system takeover if the process runs with elevated privileges.

The flaw affects the LibRaw image processing library, specifically versions 0.22.0 and 0.22.1. Any system or application using these versions is potentially vulnerable until patched or upgraded.

The CVSS base score of 9.8 marks this as a critical vulnerability, yet the EPSS score of less than 1% indicates low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted file to a LibRaw instance; therefore, the likely attack vector is a local or unauthenticated file‑processing scenario where untrusted images are processed. If an application processes images from untrusted sources, the risk is amplified, as the attacker can gain code execution within that application’s context.