RapidRAW before version 1.6.0 fails to validate the lutPath field found in preset files before passing it to File::open() in lut_processing.rs. On Windows, a preset that specifies a UNC (\\server\share) path causes the application to open that path, which initiates an outbound SMB connection to the host named in the UNC. The Windows kernel then transmits the victim’s NTLMv2 challenge‑response credentials over that network link. The weakness is an instance of improper input validation (CWE‑73) and results in a credential leak.

The vulnerable functionality is exercised on any Windows system running RapidRAW earlier than 1.6.0. Two entry points exist: the automatic download of community presets when a user opens the Community tab, and the manual import of preset files via the import dialog. The second path does not require control of the community repository and allows a counterfeit preset to be shared through Discord, forums, or other channels. Users who open or import such a preset can trigger the SMB connection.

The CVSS score of 7.1 indicates high severity, while the EPSS score of < 1 % signifies a very low but non‑zero exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Attackers only need to host an SMB share with a malicious preset. No elevated privileges are required, so any account that has permission to run RapidRAW can be compromised. The captured NTLMv2 hashes could be used by the attacker for authentication‑based attacks; the use of these hashes in pass‑the‑hash attacks is inferred but not explicitly mentioned by the vendor.