Description
LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.
Published: 2026-09-24
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

LibRaw 0.22.0 contains an improper numeric conversion in the parse_tiff_ifd function that processes the TIFF tag NewSubfileType; an attacker‑controlled value that exceeds the signed integer range is blindly converted, producing undefined behaviour that causes the parser to terminate the process, thereby denying service.

Affected Systems

Any software that links to LibRaw 0.22.0 and processes RAW, TIFF, or DNG files is affected, as the vulnerability is triggered when these file types are parsed.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score of < 1% reflects a very low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is file‑based, with a malicious file containing an out‑of‑range NewSubfileType field triggering the flaw, potentially allowing any user or remote party that can supply such a file to cause a denial of service.

Generated by OpenCVE AI on September 26, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade LibRaw to the latest release that includes the fixed conversion logic, or apply the upstream commit documented in the CVE references which resolves the numeric conversion issue.
  • If an upgrade cannot be performed immediately, isolate the vulnerable library or run the image‑parsing routine in a sandboxed environment to prevent untrusted RAW/TIFF/DNG files from terminating the application.
  • Introduce input validation so that NewSubfileType values outside the signed integer range are rejected or appropriately constrained before passing them to parse_tiff_ifd, thereby mitigating the improper numeric conversion flaw.

Generated by OpenCVE AI on September 26, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title LibRaw: LibRaw: Denial of Service via improper numeric conversion
Weaknesses CWE-681
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 25 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Libraw
Libraw libraw
Vendors & Products Libraw
Libraw libraw

Thu, 24 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.
References

Subscriptions

Libraw Libraw
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-29T02:39:24.148Z

Reserved: 2026-09-10T00:00:00.000Z

Link: CVE-2026-88387

cve-icon Vulnrichment

Updated: 2026-09-29T02:38:53.835Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T21:18:57.120

Modified: 2026-09-29T03:17:21.263

Link: CVE-2026-88387

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-88387 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T06:00:06Z

Weaknesses
  • CWE-681

    Incorrect Conversion between Numeric Types