Description
Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | darktable | 1.2.1-2 | — |
| Debian 14 | libkdcraw | 24.12.0-1 | — |
| Debian 14 | libraw | 0.15.3-1 | — |
| Debian 13 | darktable | 1.2.1-2 | — |
| Debian 13 | libkdcraw | 24.12.0-1 | — |
| Debian 13 | libraw | 0.15.3-1 | — |
| Debian 12 | darktable | 1.2.1-2 | — |
| Debian 12 | libraw | 0.15.3-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libraw | 0.17.2-1.4 | openSUSE-SU-2024:10156-1 |
Advisories 1
- openSUSE-SU-2024:10156-1 libraw-devel-0.17.2-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 53883 third-party-advisory
- 53547 third-party-advisory
- USN-1884-1 vendor-advisory
- USN-1885-1 vendor-advisory
- http://www.libraw.org/news/libraw-0-15-2
- openSUSE-SU-2013:1085 vendor-advisory
- https://github.com/LibRaw/LibRaw/commit/19ffddb0fe1a4ffdb459b797ffcf7f490d28b5a6
- [oss-security] 20130529 Re: CVE request: libraw: multiple issues mailing-list
- openSUSE-SU-2013:1083 vendor-advisory
- 53938 third-party-advisory
- [oss-security] 20130610 Re: CVE request: libraw: multiple issues mailing-list
- 53888 third-party-advisory