Incorrect Numeric Conversion in LibRaw 0.22.0 via TIFF NewSubfileType

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-88387

Affected Vendors & Products

Vendor	Product	Version / Range
libraw	libraw	0.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in LibRaw 0.22.0 where a flaw in LibRaw::parse_tiff_ifd() occurs when processing TIFF tag 0x00fe (NewSubfileType). An attacker can provide a NewSubfileType value outside the range of a signed integer. The parser converts this value to an int without checking if it is within valid bounds, leading to undefined behavior that can crash the program and cause a denial of service.

Impact Analysis

If you process RAW, TIFF, or DNG files using LibRaw 0.22.0, an attacker could exploit this flaw by providing a maliciously crafted file. This could cause the application to crash, leading to denial of service and potential loss of access to important files or services.

Mitigation Strategies

Update LibRaw to a version that fixes the incorrect numeric conversion in LibRaw::parse_tiff_ifd(). Avoid processing untrusted RAW, TIFF, or DNG files until patched.

Hi! I’m here to help you understand CVE-2026-88387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70