PT-2025-17421 · Libraw+5 · Libraw+5

Lexa · Published 2025-04-13 · Updated 2025-12-04 · CVE-2025-43964

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.21.4

Description The issue arises from the processing of tag 0x412 in the phase one correct function within decoders/load mfbacks.cpp, where minimum w0 and w1 values are not enforced.

Recommendations For versions prior to 0.21.4, update to version 0.21.4 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-1284

Related Identifiers

AZL-61756

BDU:2025-10595

CVE-2025-43964

DLA-4142-1

MGASA-2025-0316

OESA-2025-1478

OPENSUSE-SU-2025:15025-1

OPENSUSE-SU-2025_1568-1

OPENSUSE-SU-2025_1572-1

SUSE-SU-2025:01569-1

SUSE-SU-2025:01572-1

SUSE-SU-2025:1380-1

SUSE-SU-2025:1568-1

SUSE-SU-2025:1569-1

SUSE-SU-2025:1572-1

USN-7485-1

Affected Products

Alt Linux

Debian

Libraw

Linuxmint

Suse

Ubuntu

References · 60

• https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 · Patch
• https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-43961 · Security Note
• https://bdu.fstec.ru/vul/2025-10595 · Security Note
• https://ubuntu.com/security/CVE-2025-43962 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61756 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01572-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43963 · Security Note
• https://osv.dev/vulnerability/USN-7485-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43964 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15025-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1572-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7485-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43962 · Security Note