CVE-2025-43964
Fixed in a distro release EPSS <1%CVSS 2.9
In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.
Products: LibRaw
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | LibRaw | 0.19.4-1.amzn2.0.3 |
| Amazon Linux 2 | LibRaw-devel | 0.19.4-1.amzn2.0.3 |
| Amazon Linux 2 | LibRaw-static | 0.19.4-1.amzn2.0.3 |
| Debian 11 | libraw | 0.20.2-1+deb11u2 |
| Debian 12 | libraw | 0.20.2-2.1+deb12u1 |
| Debian 13 | libraw | 0.21.4-1 |
| Debian 14 | libraw | 0.21.4-1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP6 | libraw | 0.21.1-150600.3.5.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | libraw | 0.21.1-150600.3.5.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | libraw | 0.21.1-150600.3.5.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | libraw | 0.21.1-150600.3.5.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libraw | 0.15.4-45.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | libraw | 0.21.1-150600.3.5.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | libraw | 0.18.9-150000.3.30.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | libraw | 0.18.9-150000.3.30.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | libraw | 0.21.1-150600.3.5.1 |
| Ubuntu 16.04 LTS | darktable | no fix |
| Ubuntu 16.04 LTS | dcraw | no fix |
| Ubuntu 16.04 LTS | exactimage | no fix |
| Ubuntu 16.04 LTS | kodi | no fix |
| Ubuntu 16.04 LTS | rawtherapee | no fix |
| Ubuntu 16.04 LTS | ufraw | no fix |
| Ubuntu 18.04 LTS | darktable | no fix |
| Ubuntu 18.04 LTS | dcraw | no fix |
| Ubuntu 18.04 LTS | exactimage | no fix |
| Ubuntu 18.04 LTS | kodi | no fix |
| Ubuntu 18.04 LTS | rawtherapee | no fix |
| Ubuntu 18.04 LTS | ufraw | no fix |
| Ubuntu 20.04 LTS | darktable | no fix |
| Ubuntu 20.04 LTS | dcraw | no fix |
| Ubuntu 20.04 LTS | exactimage | no fix |
| Ubuntu 20.04 LTS | kodi | no fix |
| Ubuntu 20.04 LTS | libraw | 0.19.5-1ubuntu1.4 |
| Ubuntu 20.04 LTS | rawtherapee | no fix |
| Ubuntu 22.04 LTS | darktable | no fix |
| Ubuntu 22.04 LTS | dcraw | no fix |
| Ubuntu 22.04 LTS | exactimage | no fix |
| Ubuntu 22.04 LTS | kodi | no fix |
| Ubuntu 22.04 LTS | libraw | 0.20.2-2ubuntu2.22.04.2 |
| Ubuntu 22.04 LTS | rawtherapee | no fix |
| Ubuntu 24.04 LTS | darktable | no fix |
| Ubuntu 24.04 LTS | dcraw | no fix |
| Ubuntu 24.04 LTS | digikam | no fix |
| Ubuntu 24.04 LTS | exactimage | no fix |
| Ubuntu 24.04 LTS | kodi | no fix |
| Ubuntu 24.04 LTS | libraw | 0.21.2-2.1ubuntu0.24.04.1 |
| Ubuntu 24.04 LTS | rawtherapee | no fix |
| Ubuntu 25.10 | darktable | no fix |
| Ubuntu 25.10 | dcraw | no fix |
| Ubuntu 25.10 | digikam | no fix |
| Ubuntu 25.10 | exactimage | no fix |
| Ubuntu 25.10 | kodi | no fix |
| Ubuntu 25.10 | rawtherapee | no fix |
| Ubuntu 26.04 LTS | darktable | no fix |
| Ubuntu 26.04 LTS | dcraw | no fix |
| Ubuntu 26.04 LTS | digikam | no fix |
| Ubuntu 26.04 LTS | exactimage | no fix |
| Ubuntu 26.04 LTS | kodi | no fix |
| Ubuntu 26.04 LTS | rawtherapee | no fix |
| Ubuntu 26.10 | darktable | no fix |
| Ubuntu 26.10 | dcraw | no fix |
| Ubuntu 26.10 | digikam | no fix |
| Ubuntu 26.10 | exactimage | no fix |
| Ubuntu 26.10 | kodi | no fix |
| Ubuntu 26.10 | rawtherapee | no fix |
| Ubuntu Pro 16.04 LTS | digikam | no fix |
| Ubuntu Pro 16.04 LTS | libraw | 0.17.1-1ubuntu0.5+esm1 |
| Ubuntu Pro 18.04 LTS | digikam | no fix |
| Ubuntu Pro 18.04 LTS | libraw | 0.18.8-1ubuntu0.4+esm1 |
| Ubuntu Pro 20.04 LTS | digikam | no fix |
| Ubuntu Pro 22.04 LTS | digikam | no fix |
| openSUSE Leap 15.6 | libraw | 0.21.1-150600.3.5.1 |
| openSUSE Tumbleweed | libraw | 0.21.4-1.1 |