CVE-2026-88387 Details
Description
LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.
A vulnerability in LibRaw version 0.22.0 has been identified, specifically within the LibRaw::parse_tiff_ifd() function. This issue arises when the parser processes TIFF tag 0x00fe (NewSubfileType). The vulnerability allows an attacker to craft a RAW, TIFF, or DNG file that includes a NewSubfileType value exceeding the range of a signed integer. The parser improperly converts this value from a double to an int without adequate range validation, leading to undefined behavior. This flaw can cause the application to terminate unexpectedly, creating a denial-of-service condition.
Users can update to the latest version of LibRaw, where this vulnerability has been addressed, to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf | [email protected] | Source CodeVendor |
| https://github.com/LibRaw/LibRaw/issues/844 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/LibRaw/LibRaw/pull/853 | [email protected] | Issue TrackingVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| LibRaw | 0.22.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |