Out-of-Bounds Read Vulnerability in LibRaw Affects Digital Imaging Solutions

CVE-2025-43962

What is CVE-2025-43962?

LibRaw prior to version 0.21.4 contains a vulnerability in the phase_one_correct function located in decoders/load_mfbacks.cpp. This flaw allows for out-of-bounds reads when processing tag 0x412, which may occur due to excessively large values in the w0 or w1 parameters, or during the computation of fraction and multiplication operations. This vulnerability could potentially lead to information leakage or expose applications to subsequent attacks, emphasizing the need for timely updates and application security measures.

References