CVE-2026-64816
Received Received - Intake

RapidRAW LUT Path Handling NTLMv2 Credential Leak

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: VulnCheck

Description
RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-64816
EUVD
EUVD-2026-51330

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rapidweaver rapidweaver to 1.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RapidRAW before version 1.6.0 has a vulnerability where preset files are not properly validated. The lutPath field in these files can contain a UNC path on Windows, which forces the system to make an outbound SMB connection to an attacker-controlled server. This leaks the victim's NTLMv2 credentials. The issue can be triggered either through automatically fetched community presets or by importing preset files directly from untrusted sources.

Detection Guidance

Detecting this vulnerability requires monitoring for outbound SMB connections triggered by RapidRAW preset files. Check network traffic for connections to unknown hosts on port 445. On Windows, review Event Viewer for NTLMv2 authentication attempts. Use commands like 'netstat -ano | findstr 445' to identify suspicious connections.

Impact Analysis

If you use RapidRAW before 1.6.0, an attacker could steal your Windows login credentials (NTLMv2 hash) by tricking you into opening a malicious preset file or visiting the Community tab. This could lead to unauthorized access to your system or network if the credentials are reused or cracked.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing user credentials, which may be considered personal or sensitive data. Organizations using RapidRAW before 1.6.0 may face compliance risks due to potential credential theft and unauthorized access.

Mitigation Strategies

Upgrade RapidRAW to version 1.6.0 or later. Disable automatic community preset downloads in RapidRAW settings. Avoid importing preset files from untrusted sources like Discord or forums. Block outbound SMB connections at the firewall level if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart