CVE-2026-5342

Katalog CVE

CVSS 5.3 · Medium EPSS 0,98%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada libraw. Skor CVSS 3.1 5.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load_flags/raw_width can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 0.22.1 mitigates this issue. This patch is called b8397cd45657b84e88bd1202528d1764265f185c. It is advisable to upgrade the affected component.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LibRaw/LibRaw/commit/b8397cd45657b84e88bd1202528d1764265f185c patch
• https://github.com/biniamf/pocs/tree/main/libraw_nikonpadded exploit · advisory pihak ketiga
• https://vuldb.com/submit/781223 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/354671 advisory pihak ketiga · vdb entry
• https://github.com/LibRaw/LibRaw/ product
• https://github.com/LibRaw/LibRaw/issues/795 issue tracking
• https://github.com/LibRaw/LibRaw/issues/795#issuecomment-4073769886 issue tracking
• https://github.com/LibRaw/LibRaw/releases/tag/0.22.1 product · release notes
• https://vuldb.com/vuln/354671/cti permissions required · vdb entry