Description
There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | dcraw | dcraw 9.28-2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dcraw | 9.28-3 | — |
| Debian 13 | dcraw | 9.28-3 | — |
| Debian 12 | dcraw | 9.28-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | dcraw | No fix yet | — |
| Ubuntu 26.04 LTS | dcraw | No fix yet | — |
| Ubuntu 25.10 | dcraw | No fix yet | — |
| Ubuntu 24.04 LTS | dcraw | No fix yet | — |
| Ubuntu 22.04 LTS | dcraw | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | dcraw | No fix yet | — |
| Ubuntu 18.04 LTS | dcraw | No fix yet | — |
| Ubuntu 16.04 LTS | dcraw | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | dcraw | 9.28.0-3.3.1 | SUSE-SU-2022:1749-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dcraw | 9.28.0-2.1 | openSUSE-SU-2024:11997-1 |
| openSUSE Leap 15.3 | dcraw | 9.28.0-150000.3.3.1 | SUSE-SU-2022:1277-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | LibRaw +2 | 0.19.4-1.amzn2.0.6 | ALAS2-2025-3016 |
| Amazon Linux 2 | dcraw | 9.19-6.amzn2.0.3 | ALAS2-2025-3017 |
Advisories 5
- openSUSE-SU-2024:11997-1 dcraw-9.28.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1749-1 Security update for dcraw SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1277-1 Security update for dcraw SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2025-3016 Moderate: LibRaw security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 29, 2025
- ALAS2-2025-3017 Moderate: dcraw security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 29, 2025