CVE-2025-43963

Katalog CVE

CVSS 9.1 · Critical EPSS 0,44%

Kerentanan Out-of-bounds Read pada libraw. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.

Rincian

Terbit di NVD

21 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964 patch
• https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 patch · release notes
• https://www.libraw.org/news/libraw-0-21-4-release release notes
• https://lists.debian.org/debian-lts-announce/2025/04/msg00038.html