CVE-2026-88387

Deferred Deferred - Pending Action

Incorrect Numeric Conversion in LibRaw 0.22.0 via TIFF NewSubfileType

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: MITRE

Description

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-88387

Affected Vendors & Products

Vendor	Product	Version / Range
libraw	libraw	0.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-681	When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

Executive Summary

This vulnerability is in LibRaw 0.22.0 where a flaw in LibRaw::parse_tiff_ifd() occurs when processing TIFF tag 0x00fe (NewSubfileType). An attacker can provide a NewSubfileType value outside the range of a signed integer. The parser converts this value to an int without checking if it is within valid bounds, leading to undefined behavior that can crash the program and cause a denial of service.

Detection Guidance

This vulnerability is triggered by processing malformed TIFF, RAW, or DNG files with an out-of-range NewSubfileType value. Detection requires inspecting files processed by LibRaw 0.22.0 for such values. Check file metadata using tools like exiftool or file command to identify suspicious files.

Impact Analysis

If you process RAW, TIFF, or DNG files using LibRaw 0.22.0, an attacker could exploit this flaw by providing a maliciously crafted file. This could cause the application to crash, leading to denial of service and potential loss of access to important files or services.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it only causes process termination and denial of service when processing malformed files. No data exposure or privacy violation is described.

Mitigation Strategies

Update LibRaw to a version that fixes the incorrect numeric conversion in LibRaw::parse_tiff_ifd(). Avoid processing untrusted RAW, TIFF, or DNG files until patched.

Hi! I’m here to help you understand CVE-2026-88387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70