CVE-2026-64816 Details

A vulnerability in RapidRAW versions prior to 1.6.0 allows for an NTLMv2 credential leak through the lutPath field in preset files. The issue arises because the application does not properly validate this field before using it to open files. On Windows, a UNC path in lutPath triggers an outbound SMB connection to an attacker-controlled host, exposing the victim's NTLMv2 credentials. This vulnerability can be exploited in two ways: first, through community presets that are automatically downloaded from a remote repository when the Community tab is opened; second, by importing individual preset files directly via the preset import feature. The latter method does not require control of the community preset repository and can be activated by sharing preset files through platforms like Discord or forums.

Users can update to RapidRAW version 1.6.0 or later, which addresses the vulnerability by implementing proper validation of the lutPath field in preset files.