PT-2025-17420 · Libraw+5 · Libraw+5

Lexa · Published 2025-04-13 · Updated 2025-12-04 · CVE-2025-43963

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.21.4

Description The issue arises from the phase one correct function in decoders/load mfbacks.cpp, which allows out-of-buffer access. This occurs because the split col and split row values are not checked during the processing of the 0x041f tag.

Recommendations For versions prior to 0.21.4, update to version 0.21.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the load mfbacks.cpp decoder to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-61810

BDU:2025-10598

CVE-2025-43963

DLA-4142-1

MGASA-2025-0316

OESA-2025-1478

OPENSUSE-SU-2025:15025-1

OPENSUSE-SU-2025_1568-1

OPENSUSE-SU-2025_1572-1

SUSE-SU-2025:01569-1

SUSE-SU-2025:01572-1

SUSE-SU-2025:1568-1

SUSE-SU-2025:1569-1

SUSE-SU-2025:1572-1

USN-7485-1

Affected Products

Alt Linux

Debian

Libraw

Linuxmint

Suse

Ubuntu

References · 56

• https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 · Patch
• https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-43961 · Security Note
• https://ubuntu.com/security/CVE-2025-43962 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10598 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01572-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43963 · Security Note
• https://osv.dev/vulnerability/AZL-61810 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-43963 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7485-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-43963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43964 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15025-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-43963 · Security Note