CVE-2025-43961
published 2025-04-21CVE-2025-43961: In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
PriorityP339critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.42%
34.3th percentile
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libraw | < libraw 0.20.2-2.1+deb12u1 (bookworm) | libraw 0.20.2-2.1+deb12u1 (bookworm) |
| libraw | libraw | < 0.21.4 | 0.21.4 |
| libraw | libraw | >= 0 < 0.20.2-1+deb11u2 | 0.20.2-1+deb11u2 |
| libraw | libraw | >= 0 < 0.20.2-2.1+deb12u1 | 0.20.2-2.1+deb12u1 |
| libraw | libraw | >= 0 < 0.21.4-1 | 0.21.4-1 |
| libraw | libraw | >= 0 < 0.21.4-1 | 0.21.4-1 |
| libraw | libraw | >= 0 < 0.19.5-1ubuntu1.4 | 0.19.5-1ubuntu1.4 |
| libraw | libraw | >= 0 < 0.20.2-2ubuntu2.22.04.2 | 0.20.2-2ubuntu2.22.04.2 |
| libraw | libraw | >= 0 < 0.21.2-2.1ubuntu0.24.04.1 | 0.21.2-2.1ubuntu0.24.04.1 |
| libraw | libraw | >= 0 < 0.17.1-1ubuntu0.5+esm1 | 0.17.1-1ubuntu0.5+esm1 |
| libraw | libraw | >= 0 < 0.18.8-1ubuntu0.4+esm1 | 0.18.8-1ubuntu0.4+esm1 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
osv9.1CRITICAL
vendor_debian2.9LOW
vendor_redhat2.9LOW
vendor_ubuntu2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
LibRaw vulnerabilities
vendor_ubuntu·2025-05-06·CVSS 2.9
CVE-2025-43961 [LOW] LibRaw vulnerabilities
Title: LibRaw vulnerabilities
Summary: LibRaw could be made to crash if it received specially crafted input.
It was discovered that LibRaw could be made to read out of bounds. An
attacker could possibly use this issue to cause applications using LibRaw
to crash, resulting in a denial of service. (CVE-2025-43961,
CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)
Instructions: After a standard system update you need to restart your session to make all
the necessary changes.
Red Hat
LibRaw: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw
vendor_redhat·2025-04-20·CVSS 2.9
CVE-2025-43961 [LOW] CWE-125 LibRaw: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw
LibRaw: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
A flaw was found in LibRaw. In affected versions of LibRaw, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: libraw1394 (Red Hat Enterprise Linux 6) - Fix deferred
Package: LibRaw (Red Hat Enterprise Linux 7) - Fix deferred
Package: libraw1394 (Red Hat Enterprise Linux 7) - Fix deferred
Package: LibRaw (Red Hat Enterprise Linux 8) - Fi
Debian
CVE-2025-43961: libraw - In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fuji...
vendor_debian·2025·CVSS 2.9
CVE-2025-43961 [LOW] CVE-2025-43961: libraw - In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fuji...
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
Scope: local
bookworm: resolved (fixed in 0.20.2-2.1+deb12u1)
bullseye: resolved (fixed in 0.20.2-1+deb11u2)
forky: resolved (fixed in 0.21.4-1)
sid: resolved (fixed in 0.21.4-1)
trixie: resolved (fixed in 0.21.4-1)
OSV
libraw vulnerabilities
osv·2025-05-06·CVSS 9.1
CVE-2025-43961 [CRITICAL] libraw vulnerabilities
libraw vulnerabilities
It was discovered that LibRaw could be made to read out of bounds. An
attacker could possibly use this issue to cause applications using LibRaw
to crash, resulting in a denial of service. (CVE-2025-43961,
CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)
OSV
CVE-2025-43961: In LibRaw before 0
osv·2025-04-21·CVSS 9.1
CVE-2025-43961 [CRITICAL] CVE-2025-43961: In LibRaw before 0
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
GHSA
GHSA-m4w2-g4cp-m5hw: In LibRaw before 0
ghsa_unreviewed·2025-04-21
CVE-2025-43961 [LOW] CWE-125 GHSA-m4w2-g4cp-m5hw: In LibRaw before 0
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [epel-9]
bugzilla·2025-04-21·CVSS 9.1
CVE-2025-43961 [CRITICAL] CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [epel-9]
CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [epel-9]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2361283
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
---
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Bugzilla
CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [epel-8]
bugzilla·2025-04-21·CVSS 9.1
CVE-2025-43961 [CRITICAL] CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [epel-8]
CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [epel-8]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2361283
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
---
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Bugzilla
CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [fedora-42]
bugzilla·2025-04-21·CVSS 9.1
CVE-2025-43961 [CRITICAL] CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [fedora-42]
CVE-2025-43961 digikam: Out-of-Bounds Read in Fujifilm 0xf00c Tag Parser in LibRaw [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2361283
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
update internal Libraw to 2025/03/17 snapshot fixes this?
https://invent.kde.org/graphics/digikam/-/commit/0f6467b6a6f8203e4574854e6b4604e39902dc08
---
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
2025-04-21
Published