CVE-2025-43962

Katalog CVE

CVSS 9.1 · Critical EPSS 0,44%

Kerentanan Out-of-bounds Read pada libraw. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.

Rincian

Terbit di NVD

21 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2 patch
• https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 patch · release notes
• https://www.libraw.org/news/libraw-0-21-4-release release notes
• https://lists.debian.org/debian-lts-announce/2025/04/msg00038.html