CVE-2026-111272
No fix known EPSS <1%CVSS 5.5
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.
Products: LibRaw
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libraw | no fix |
| Debian 13 | libraw | no fix |
| Debian 14 | libraw | no fix |
| Ubuntu 16.04 LTS | darktable | no fix |
| Ubuntu 16.04 LTS | dcraw | no fix |
| Ubuntu 16.04 LTS | exactimage | no fix |
| Ubuntu 16.04 LTS | kodi | no fix |
| Ubuntu 16.04 LTS | rawtherapee | no fix |
| Ubuntu 16.04 LTS | ufraw | no fix |
| Ubuntu 18.04 LTS | darktable | no fix |
| Ubuntu 18.04 LTS | dcraw | no fix |
| Ubuntu 18.04 LTS | exactimage | no fix |
| Ubuntu 18.04 LTS | kodi | no fix |
| Ubuntu 18.04 LTS | rawtherapee | no fix |
| Ubuntu 18.04 LTS | ufraw | no fix |
| Ubuntu 20.04 LTS | darktable | no fix |
| Ubuntu 20.04 LTS | dcraw | no fix |
| Ubuntu 20.04 LTS | exactimage | no fix |
| Ubuntu 20.04 LTS | kodi | no fix |
| Ubuntu 20.04 LTS | libraw | no fix |
| Ubuntu 20.04 LTS | rawtherapee | no fix |
| Ubuntu 22.04 LTS | darktable | no fix |
| Ubuntu 22.04 LTS | dcraw | no fix |
| Ubuntu 22.04 LTS | exactimage | no fix |
| Ubuntu 22.04 LTS | kodi | no fix |
| Ubuntu 22.04 LTS | libraw | no fix |
| Ubuntu 22.04 LTS | rawtherapee | no fix |
| Ubuntu 24.04 LTS | darktable | no fix |
| Ubuntu 24.04 LTS | dcraw | no fix |
| Ubuntu 24.04 LTS | digikam | no fix |
| Ubuntu 24.04 LTS | exactimage | no fix |
| Ubuntu 24.04 LTS | kodi | no fix |
| Ubuntu 24.04 LTS | libraw | no fix |
| Ubuntu 24.04 LTS | rawtherapee | no fix |
| Ubuntu 26.04 LTS | darktable | no fix |
| Ubuntu 26.04 LTS | dcraw | no fix |
| Ubuntu 26.04 LTS | digikam | no fix |
| Ubuntu 26.04 LTS | exactimage | no fix |
| Ubuntu 26.04 LTS | kodi | no fix |
| Ubuntu 26.04 LTS | libraw | no fix |
| Ubuntu 26.04 LTS | rawtherapee | no fix |
| Ubuntu 26.10 | darktable | no fix |
| Ubuntu 26.10 | dcraw | no fix |
| Ubuntu 26.10 | digikam | no fix |
| Ubuntu 26.10 | exactimage | no fix |
| Ubuntu 26.10 | kodi | no fix |
| Ubuntu 26.10 | libraw | no fix |
| Ubuntu 26.10 | rawtherapee | no fix |
| Ubuntu Pro 16.04 LTS | digikam | no fix |
| Ubuntu Pro 16.04 LTS | libraw | no fix |
| Ubuntu Pro 18.04 LTS | digikam | no fix |
| Ubuntu Pro 18.04 LTS | libraw | no fix |
| Ubuntu Pro 20.04 LTS | digikam | no fix |
| Ubuntu Pro 22.04 LTS | digikam | no fix |