Description
A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LibRaw | LibRaw-demosaic-pack-GPL2 | 0.x prior to 0.18.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | libraw | 0.15.4-9.2 | SUSE-SU-2017:2300-1 |
| SLES 12 SP2 | libraw | 0.15.4-9.2 | SUSE-SU-2017:2300-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libraw | 0.20.2-4.1 | openSUSE-SU-2024:10980-1 |
Advisories 2
- openSUSE-SU-2024:10980-1 libraw-devel-0.20.2-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2300-1 Security update for libraw SUSE / openSUSE Security Updates · Feb 4, 2026