RawTherapee has an integer overflow or wraparound vulnerability in its rtengine modules, specifically involving files in dcraw.Cc. The flaw can result in a memory corruption that may allow an attacker to execute arbitrary code, overwrite data, or cause the application to crash. The impact threatens confidentiality, integrity, and availability of systems that use the affected software.

RawTherapee, versions through 5.11 inclusive, are affected. No newer releases are listed as vulnerable.

The CVSS score is 8.3, indicating high severity. The EPSS score is below 1%, implying a low likelihood of exploitation at this time. The vulnerability is not yet catalogued in the CISA KEV list. Exploitation would require an attacker to supply a crafted RAW image file processed by the application, potentially through local user interaction or remote file transfer if the user opens files from shared locations. The attack vector is inferred from the nature of the flaw and typical usage of RAW files.