Every CVE Search/ Get API key

CVE-2018-19565

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to...

7.1 HighFix available

CVE-2018-19565 is a high vulnerability (CVSS 7.1) in Dcraw Project Dcraw, published November 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 64th percentile. Fixed in dcraw 9.28.0-6.1.mga8.

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

1.07%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
CVE-2018-19565
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
CVE-2018-19565
Updated
2026-11-02
EUVDEUVD-2018-11254 No score

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
EUVD-2018-11254
Updated
2026-11-03
GitHub AdvisoriesGHSA-682q-f6x6-8x24 7.1

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to...

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
GHSA-682q-f6x6-8x24
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 7.1

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
CVE-2018-19565
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19565 7.1

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
DEBIAN-CVE-2018-19565
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2018-19565 7.1

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Record
UBUNTU-CVE-2018-19565
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2022-0160 No score

Updated dcraw packages fix security vulnerability

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19565)

A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19566)

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. (CVE-2018-19567)

A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. (CVE-2018-19568)

A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash. (CVE-2018-5805)

An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system. (CVE-2021-3624)

Record
MGASA-2022-0160
Updated
2026-11-02
OSVSUSE-SU-2022:1277-1 No score

Security update for dcraw

This update for dcraw fixes the following issues:

  • CVE-2017-13735: Fixed a denial of service issue due to a floating point exception (bsc#1056170).
  • CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1063798).
  • CVE-2018-19655: Fixed a buffer overflow that could lead to an application crash (bsc#1117896).
  • CVE-2018-5801: Fixed an invalid memory access that could lead to denial of service (bsc#1084690).
  • CVE-2018-5805: Fixed a buffer overflow that could lead to an application crash (bsc#1097973).
  • CVE-2018-5806: Fixed an invalid memory access that could lead to denial of service (bsc#1097974).
  • CVE-2018-19565: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117622).
  • CVE-2018-19566: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117517).
  • CVE-2018-19567: Fixed a denial of service issue due to a floating point exception (bsc#1117512).
  • CVE-2018-19568: Fixed a denial of service issue due to a floating point exception (bsc#1117436).
  • CVE-2021-3624: Fixed a buffer overflow that could lead to code execution or denial of service (bsc#1189642).

Non-security fixes:

  • Updated to version 9.28.0.
Record
SUSE-SU-2022:1277-1
Updated
2026-11-02
OSVSUSE-SU-2022:1749-1 No score

Security update for dcraw

This update for dcraw fixes the following issues:

  • CVE-2017-13735: Fixed a denial of service issue due to a floating point exception (bsc#1056170).
  • CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1063798).
  • CVE-2018-19655: Fixed a buffer overflow that could lead to an application crash (bsc#1117896).
  • CVE-2018-5801: Fixed an invalid memory access that could lead to denial of service (bsc#1084690).
  • CVE-2018-5805: Fixed a buffer overflow that could lead to an application crash (bsc#1097973).
  • CVE-2018-5806: Fixed an invalid memory access that could lead to denial of service (bsc#1097974).
  • CVE-2018-19565: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117622).
  • CVE-2018-19566: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117517).
  • CVE-2018-19567: Fixed a denial of service issue due to a floating point exception (bsc#1117512).
  • CVE-2018-19568: Fixed a denial of service issue due to a floating point exception (bsc#1117436).
  • CVE-2021-3624: Fixed a buffer overflow that could lead to code execution or denial of service (bsc#1189642).

Non-security fixes:

  • Updated to version 9.28.0.
Record
SUSE-SU-2022:1749-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dcraw
Debian:12
 All versions, plus listed versions
9.28-39.28-3.19.28-49.28-59.28-5.19.28-69.28-79.28-8
 None known
dcraw
Debian:13
 All versions, plus listed versions
9.28-8
 None known
dcraw
Debian:14
 All versions, plus listed versions
9.28-8
 None known
dcraw
Mageia:8
 before 9.28.0-6.1.mga8
9.28.0-6.1.mga8
dcraw
openSUSE:Leap 15.3
 before 9.28.0-150000.3.3.1
9.28.0-150000.3.3.1
dcraw
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 9.28.0-3.3.1
9.28.0-3.3.1
dcraw
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 9.28.0-3.3.1
9.28.0-3.3.1
dcraw
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.21-0.2
 None known
dcraw
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.27-1ubuntu1
 None known
dcraw
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.28-2
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
dcraw
Ubuntu:22.04:LTS
 All versions, plus listed versions
9.28-29.28-3
 None known
dcraw
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.28-39.28-3.1ubuntu19.28-5ubuntu1
 None known
dcraw
Ubuntu:25.10
 All versions, plus listed versions
9.28-8
 None known
dcraw
Ubuntu:26.10
 All versions, plus listed versions
9.28-8build1
 None known
dcraw
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.28-89.28-8build1
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open