CVE-2023-1729 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libraw

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-787 — Out-of-bounds WriteCWE-413 — Improper Resource Locking12 documents8 sources
Severity
6.5MEDIUMNVD
OSV5.5
EPSS
0.1%
top 80.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LibrawLinux KernelFedoraproject Fedora+1 more
Timeline
PublishedMay 15
Latest updateDec 9

Description

A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlibraw/libraw< 0.21.2
▶Debianlibraw/libraw< 0.20.2-1+deb11u1+3
▶CVEListV5libraw/librawLibRaw 0.21.1
▶Linuxlinux/linux_kernel5.18.0 — 6.5.4

Also affects: Fedora 37, 38, Enterprise Linux 7.0, 8.0, 9.0

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

5
OSV
bpf: bpf_sk_storage: Fix invalid wait context lockdep report↗2025-12-09
▶
OSV
digikam vulnerabilities↗2025-02-13
▶
GHSA
GHSA-5gp6-9w92-5752: A flaw was found in LibRaw↗2023-05-16
▶
OSV
CVE-2023-1729: A flaw was found in LibRaw↗2023-05-15
▶
CVEList
CVE-2023-1729: A flaw was found in LibRaw↗2023-05-15
▶

📋Vendor Advisories

5
Red Hat
kernel: bpf: bpf_sk_storage: Fix invalid wait context lockdep report↗2025-12-09
▶
Ubuntu
digiKam vulnerabilities↗2025-02-13
▶
Ubuntu
LibRaw vulnerabilities↗2023-06-05
▶
Red Hat
LibRaw: a heap-buffer-overflow in raw2image_ex()↗2023-01-14
▶
Debian
CVE-2023-1729: libraw - A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a...↗2023
▶
CVE-2023-1729 — Libraw vulnerability | cvebase