LibRaw Vulnerability CVE-2025-43964: Insufficient Tag Processing in Phase One Correction
Summary
CVE-2025-43964: In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. Affects libraw across 2 version ranges.
< 0.20.2-1+deb11u2
< a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0
Fixed in 0.20.2-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibRaw is an open-source library designed for reading and processing raw image files from digital cameras. It provides a range of functionalities, including decoding raw images, applying color corrections, and converting images to various formats. This library is widely used in image processing applications and is integral for photographers and developers working with raw image data. However, a recent vulnerability has been identified that affects its processing capabilities.
Vulnerability Detail
In LibRaw versions prior to 0.21.4, there is a flaw in the processing of tag 0x412 within the phase_one_correct function located in the decoders/load_mfbacks.cpp file. This vulnerability does not enforce minimum values for parameters w0 and w1, which could lead to unexpected behavior or crashes when processing certain raw image files. The lack of validation may allow attackers to exploit this issue, potentially leading to denial of service or other unintended consequences.
How To Fix
Minimum fixed version
0.20.2-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade librawTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing raw files that are known to trigger this vulnerability until the library is updated. Additionally, implementing input validation in the application that uses LibRaw may help mitigate the risk until an update can be applied.
Conclusion
The CVE-2025-43964 vulnerability in LibRaw highlights a critical issue in the processing of raw image files. Users are strongly advised to update to the latest version to mitigate potential risks. By following the recommended steps and utilizing available tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for libraw →
FAQ
CVE-2025-43964 is a vulnerability in LibRaw that affects the processing of specific tags, potentially leading to crashes or unexpected behavior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of LibRaw prior to 0.21.4 are affected by this vulnerability.
If you cannot update immediately, avoid processing raw files that may exploit this vulnerability and consider implementing input validation in your application.
More information about LibRaw can be found on its official website and documentation, which provide details on its features and usage.
Related vulnerabilities
Recent vulnerabilities recorded for libraw.
