The vulnerability lies in the uncompressed_fp_dng_load_raw routine of LibRaw, where an integer overflow can cause a heap buffer overflow when processing a specially crafted DNG file. This flaw can be leveraged to execute arbitrary code within the context of the application that uses LibRaw. The underlying weakness is an integer overflow identified as CWE‑190, and the flaw is classified as high severity.

This flaw affects the LibRaw library version 0.22.1. Any software—desktop, mobile, or embedded—that incorporates this version of LibRaw for image handling and processes DNG files is potentially vulnerable. The impact is limited to environments where a DNG file is parsed by an application using LibRaw.

The CVSS score of 8.1 denotes a high severity. The EPSS score of less than 1% suggests current exploitation is unlikely, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a malicious DNG file supplied either locally by a user or obtained over a network, which an application using LibRaw will load. The prerequisite for exploitation is minimal: the presence of LibRaw 0.22.1 and the ability to trigger the vulnerable function with a crafted file.