LibRaw 0.21 contains a buffer overflow flaw in the stretch() function (src/libraw_cxx.cpp) and the fuji_rotate() function (src/decoders/fuji.cpp). The overflow can be triggered by a specially crafted RAW image file, potentially allowing an attacker to execute arbitrary code when the library processes such a file, as categorized by CWE‑122.

This vulnerability affects only deployments that use LibRaw version 0.21 to process RAW image files. No vendor or product names are listed, so any system that imports this library and processes images (particularly Fuji camera data) is potentially impacted.

The CVSS score of 8.8 highlights the high severity of this issue. The EPSS score is not available and it is not listed in CISA's KEV catalog, but a buffer overflow remains a critical attack vector. The likely attack path involves an attacker supplying a malicious RAW file to a system that uses LibRaw 0.21 for image processing; if exploited, it could lead to full control over the affected process.