CVE-2025-43963: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in…

PriorityP349critical9.1CVSS 3.1

AVNACLPRNUINSUCHINAH

EPSS

0.39%

31.1th percentile

In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	libraw	< libraw 0.20.2-2.1+deb12u1 (bookworm)	libraw 0.20.2-2.1+deb12u1 (bookworm)
libraw	libraw	< 0.21.4	0.21.4
libraw	libraw	>= 0 < 0.20.2-1+deb11u2	0.20.2-1+deb11u2
libraw	libraw	>= 0 < 0.20.2-2.1+deb12u1	0.20.2-2.1+deb12u1
libraw	libraw	>= 0 < 0.21.4-1	0.21.4-1
libraw	libraw	>= 0 < 0.21.4-1	0.21.4-1
libraw	libraw	>= 0 < 0.19.5-1ubuntu1.4	0.19.5-1ubuntu1.4
libraw	libraw	>= 0 < 0.20.2-2ubuntu2.22.04.2	0.20.2-2ubuntu2.22.04.2
libraw	libraw	>= 0 < 0.21.2-2.1ubuntu0.24.04.1	0.21.2-2.1ubuntu0.24.04.1
libraw	libraw	>= 0 < 0.17.1-1ubuntu0.5+esm1	0.17.1-1ubuntu0.5+esm1
libraw	libraw	>= 0 < 0.18.8-1ubuntu0.4+esm1	0.18.8-1ubuntu0.4+esm1

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

osv9.1CRITICAL

vendor_debian2.9LOW

vendor_redhat2.9LOW

vendor_ubuntu2.9LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.