Remote Code Execution Vulnerability in RapidRAW by CyberTimon

CVE-2026-64816

What is CVE-2026-64816?

RapidRAW versions prior to 1.6.0 contain a vulnerability that fails to properly validate the lutPath field in preset files, allowing for unintended outbound SMB connections. This issue is particularly concerning on Windows systems, where a malicious UNC path can lead to the unintentional leak of NTLMv2 credentials to an attacker-controlled host. The vulnerability can be exploited through community presets fetched from a remote repository or via individual presets imported by users from various platforms such as Discord or online forums, thereby facilitating unauthorized access and potential credential theft.

References