Heap-based Out-of-Bounds Read in LibRaw

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111272

Affected Vendors & Products

Vendor	Product	Version / Range
LibRaw	LibRaw	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

LibRaw through version 0.22.2 has a heap-based out-of-bounds read vulnerability in the LibRaw::parseNikonMakernote() function. This flaw allows attackers to read memory beyond a short ShotInfo buffer by providing a specially crafted Nikon NEF/TIFF image file with a 5-byte ShotInfo tag declaring version 243, which can crash applications processing the image.

Impact Analysis

This vulnerability could allow attackers to crash applications that use LibRaw to process Nikon NEF/TIFF images. If exploited, it may lead to denial-of-service conditions or potentially unauthorized memory access, though it does not directly enable code execution or data theft.

Mitigation Strategies

Update LibRaw to version 0.22.3 or later to address the heap-based out-of-bounds read vulnerability in LibRaw::parseNikonMakernote().

Hi! I’m here to help you understand CVE-2026-111272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70