CVE-2025-43964

published 2025-04-21

CVE-2025-43964: In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.

Priority P3 43 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	libraw	< libraw 0.20.2-2.1+deb12u1 (bookworm)	libraw 0.20.2-2.1+deb12u1 (bookworm)
libraw	libraw	< 0.21.4	0.21.4
libraw	libraw	>= 0 < 0.20.2-1+deb11u2	0.20.2-1+deb11u2
libraw	libraw	>= 0 < 0.20.2-2.1+deb12u1	0.20.2-2.1+deb12u1
libraw	libraw	>= 0 < 0.21.4-1	0.21.4-1
libraw	libraw	>= 0 < 0.21.4-1	0.21.4-1
libraw	libraw	>= 0 < 0.19.5-1ubuntu1.4	0.19.5-1ubuntu1.4
libraw	libraw	>= 0 < 0.20.2-2ubuntu2.22.04.2	0.20.2-2ubuntu2.22.04.2
libraw	libraw	>= 0 < 0.21.2-2.1ubuntu0.24.04.1	0.21.2-2.1ubuntu0.24.04.1
libraw	libraw	>= 0 < 0.17.1-1ubuntu0.5+esm1	0.17.1-1ubuntu0.5+esm1
libraw	libraw	>= 0 < 0.18.8-1ubuntu0.4+esm1	0.18.8-1ubuntu0.4+esm1

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv 9.8 CRITICAL

vendor_debian 2.9 LOW

vendor_redhat 2.9 LOW

vendor_ubuntu 2.9 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1284