CVE-2025-43963
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
CVE-2025-43963- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-11960
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
EUVD-2025-11960- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3w5w-m35v-rfp7
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
GHSA-3w5w-m35v-rfp7- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
CVE-2025-43963- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVAZL-61810
CVE-2025-43963 affecting package LibRaw 0.21.3-1
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
AZL-61810- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-05
OSV
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
CVE-2025-43963- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2025-43963
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
DEBIAN-CVE-2025-43963- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-1111
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
JLSEC-2026-1111- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1478
LibRaw security update
LibRaw is a library for reading RAW files from digital photo cameras (CRW/CR2, NEF, RAF, etc, virtually all RAW formats are supported).It pays special attention to correct retrieval of data required for subsequent RAW conversion.The library is intended for embedding in RAW converters, data analyzers, and other programs using RAW files as the initial data.
Security Fix(es):
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.(CVE-2025-43961)
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.(CVE-2025-43962)
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.(CVE-2025-43963)
In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.(CVE-2025-43964)
- Record
OESA-2025-1478- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-43963
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.
- Record
UBUNTU-CVE-2025-43963- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1785317741 No score
LibRaw: Fix of 4 CVEs
- CVE-2025-43961 CVE-2025-43962 CVE-2025-43963 CVE-2025-43964: fix out-of-bounds reads in the Phase One / Fujifilm metadata decoders (phase_one_correct / fuji 0xf00c); backport upstream 0.21.4 fixes
- Record
CLSA-2026-1785317741- Updated
- 2026-11-02
OSVCLSA-2026-1785408515 No score
LibRaw: Fix of 4 CVEs
- CVE-2025-43961 CVE-2025-43962 CVE-2025-43963 CVE-2025-43964: fix out-of-bounds reads in the Phase One / Fujifilm metadata decoders (phase_one_correct / fuji 0xf00c); backport upstream 0.21.4 fixes
- Record
CLSA-2026-1785408515- Updated
- 2026-11-02
OSVMGASA-2025-0316 No score
Updated libraw, digikam & darktable packages fix security vulnerabilities
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. (CVE-2025-43961) In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations. (CVE-2025-43962) In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing. (CVE-2025-43963) In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. (CVE-2025-43964)
- Record
MGASA-2025-0316- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15025-1 No score
libraw-devel-0.21.4-1.1 on GA media
These are all security issues fixed in the libraw-devel-0.21.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15025-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01569-1 No score
Security update for libraw
This update for libraw fixes the following issues:
- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)
- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)
- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)
- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct does not enforce minimum w0 and w1 values (bsc#1241584)
- Record
SUSE-SU-2025:01569-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01572-1 No score
Security update for libraw
This update for libraw fixes the following issues:
- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)
- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)
- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)
- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct does not enforce minimum w0 and w1 values (bsc#1241584)
- Record
SUSE-SU-2025:01572-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1568-1 No score
Security update for libraw
This update for libraw fixes the following issues:
- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)
- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)
- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)
- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct does not enforce minimum w0 and w1 values (bsc#1241584)
- Record
SUSE-SU-2025:1568-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1569-1 No score
Security update for libraw
This update for libraw fixes the following issues:
- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)
- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)
- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)
- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct does not enforce minimum w0 and w1 values (bsc#1241584)
- Record
SUSE-SU-2025:1569-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1572-1 No score
Security update for libraw
This update for libraw fixes the following issues:
- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)
- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)
- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)
- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct does not enforce minimum w0 and w1 values (bsc#1241584)
- Record
SUSE-SU-2025:1572-1- Updated
- 2026-11-02
OSVUSN-7485-1 No score
libraw vulnerabilities
It was discovered that LibRaw could be made to read out of bounds. An attacker could possibly use this issue to cause applications using LibRaw to crash, resulting in a denial of service. (CVE-2025-43961, CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)
- Record
USN-7485-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
LibRawAzure Linux:3 |
through 0.21.3-1 | None known |
LibRawTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 0.21.1-1.el9.tuxcare.els3 | 0.21.1-1.el9.tuxcare.els3 |
LibRaw-develTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 0.21.1-1.el9.tuxcare.els3 | 0.21.1-1.el9.tuxcare.els3 |
LibRaw-samplesTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 0.21.1-1.el9.tuxcare.els3 | 0.21.1-1.el9.tuxcare.els3 |
LibRaw-staticTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 0.21.1-1.el9.tuxcare.els3 | 0.21.1-1.el9.tuxcare.els3 |
LibRawTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 0.20.2-5.el9_2.tuxcare.els6 | 0.20.2-5.el9_2.tuxcare.els6 |
LibRaw-develTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 0.20.2-5.el9_2.tuxcare.els6 | 0.20.2-5.el9_2.tuxcare.els6 |
LibRaw-samplesTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 0.20.2-5.el9_2.tuxcare.els6 | 0.20.2-5.el9_2.tuxcare.els6 |
LibRaw-staticTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 0.20.2-5.el9_2.tuxcare.els6 | 0.20.2-5.el9_2.tuxcare.els6 |
librawDebian:12 |
before 0.20.2-2.1+deb12u1, plus listed versions 0.20.2-2.1 |
0.20.2-2.1+deb12u1 |
Show 82 moreShow less
| Package | Affected | Fixed |
|---|---|---|
librawDebian:13 |
before 0.21.4-1 | 0.21.4-1 |
librawDebian:14 |
before 0.21.4-1 | 0.21.4-1 |
librawDebian:11 From an advisory covering 4 CVEs |
before 0.20.2-1+deb11u2, plus listed versions 0.20.2-10.20.2-1+deb11u1 |
0.20.2-1+deb11u2 |
LibRaw_jllJulia |
before 0.22.1+0 | 0.22.1+0 |
librawMageia:9 From an advisory covering 4 CVEs |
before 0.20.2-5.1.mga9 | 0.20.2-5.1.mga9 |
digikamMageia:9 From an advisory covering 4 CVEs |
before 8.4.0-1.1.mga9 | 8.4.0-1.1.mga9 |
darktableMageia:9 From an advisory covering 4 CVEs |
before 4.6.1-1.2.mga9 | 4.6.1-1.2.mga9 |
LibRawopenEuler:24.03-LTS From an advisory covering 4 CVEs |
before 0.21.1-4.oe2403sp1 | 0.21.1-4.oe2403sp1 |
LibRawopenEuler:24.03-LTS-SP1 From an advisory covering 4 CVEs |
before 0.21.1-4.oe2403sp1 | 0.21.1-4.oe2403sp1 |
LibRawopenEuler:20.03-LTS-SP4 From an advisory covering 4 CVEs |
before 0.20.2-8.oe2003sp4 | 0.20.2-8.oe2003sp4 |
LibRawopenEuler:22.03-LTS-SP3 From an advisory covering 4 CVEs |
before 0.20.2-9.oe2203sp3 | 0.20.2-9.oe2203sp3 |
LibRawopenEuler:22.03-LTS-SP4 From an advisory covering 4 CVEs |
before 0.20.2-9.oe2203sp4 | 0.20.2-9.oe2203sp4 |
librawSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 4 CVEs |
before 0.18.9-150000.3.30.1 | 0.18.9-150000.3.30.1 |
librawSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawSUSE:Linux Enterprise Workstation Extension 15 SP6 From an advisory covering 4 CVEs |
before 0.18.9-150000.3.30.1 | 0.18.9-150000.3.30.1 |
librawSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawSUSE:Linux Enterprise Workstation Extension 15 SP6 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawopenSUSE:Leap 15.6 From an advisory covering 4 CVEs |
before 0.21.1-150600.3.5.1 | 0.21.1-150600.3.5.1 |
librawUbuntu:Pro:16.04:LTS |
before 0.17.1-1ubuntu0.5+esm1, plus listed versions 0.16.2-10.17.0-10.17.1-10.17.1-1ubuntu0.10.17.1-1ubuntu0.20.17.1-1ubuntu0.30.17.1-1ubuntu0.40.17.1-1ubuntu0.5 |
0.17.1-1ubuntu0.5+esm1 |
darktableUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.8-11.6.9-12.0.0-12.0.1-12.0.3-1 |
None known |
dcrawUbuntu:16.04:LTS |
All versions, plus listed versions 9.21-0.2 |
None known |
digikamUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4:4.12.0-0ubuntu54:4.12.0-0ubuntu64:4.12.0-0ubuntu74:4.12.0-0ubuntu7+esm1 |
None known |
exactimageUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.1-6build10.9.1-6ubuntu10.9.1-8ubuntu10.9.1-90.9.1-9build1 Show 4 moreShow less0.9.1-100.9.1-110.9.1-120.9.1-12ubuntu1 |
None known |
kodiUbuntu:16.04:LTS |
All versions, plus listed versions 15.1+dfsg1-315.2+dfsg1-1build115.2+dfsg1-315.2+dfsg1-3ubuntu115.2+dfsg1-3ubuntu1.1 |
None known |
rawtherapeeUbuntu:16.04:LTS |
All versions, plus listed versions 4.2-2build14.2-4 |
None known |
ufrawUbuntu:16.04:LTS |
All versions, plus listed versions 0.20-3build1 |
None known |
librawUbuntu:Pro:18.04:LTS |
before 0.18.8-1ubuntu0.4+esm1, plus listed versions 0.18.2-20.18.5-10.18.7-20.18.8-10.18.8-1ubuntu0.10.18.8-1ubuntu0.20.18.8-1ubuntu0.30.18.8-1ubuntu0.4 |
0.18.8-1ubuntu0.4+esm1 |
darktableUbuntu:18.04:LTS |
All versions, plus listed versions 2.2.5-22.4.0-12.4.1-12.4.2-1 |
None known |
dcrawUbuntu:18.04:LTS |
All versions, plus listed versions 9.27-1ubuntu1 |
None known |
digikamUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4:5.6.0-0ubuntu24:5.6.0-0ubuntu34:5.6.0-0ubuntu44:5.6.0-0ubuntu74:5.6.0-0ubuntu84:5.6.0-0ubuntu94:5.6.0-0ubuntu104:5.6.0-0ubuntu10+esm1 |
None known |
exactimageUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.2-1build11.0.1-1 |
None known |
kodiUbuntu:18.04:LTS |
All versions, plus listed versions 2:17.3+dfsg1-32:17.3+dfsg1-3build12:17.3+dfsg1-52:17.3+dfsg1-5build12:17.3+dfsg1-5build22:17.6+dfsg1-12:17.6+dfsg1-1build12:17.6+dfsg1-1ubuntu1 |
None known |
rawtherapeeUbuntu:18.04:LTS |
All versions, plus listed versions 5.2-15.3-1 |
None known |
ufrawUbuntu:18.04:LTS |
All versions, plus listed versions 0.22-1.10.22-20.22-30.22-3.1~build0.18.04.10.22-3.1ubuntu0.1 |
None known |
librawUbuntu:20.04:LTS |
before 0.19.5-1ubuntu1.4, plus listed versions 0.19.5-10.19.5-1ubuntu10.19.5-1ubuntu1.10.19.5-1ubuntu1.20.19.5-1ubuntu1.3 |
0.19.5-1ubuntu1.4 |
darktableUbuntu:20.04:LTS |
All versions, plus listed versions 2.6.0-12.6.2-32.6.3-12.6.3-1build12.6.3-1build23.0.1-0ubuntu1 |
None known |
dcrawUbuntu:20.04:LTS |
All versions, plus listed versions 9.28-2 |
None known |
digikamUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4:5.9.0-1ubuntu44:6.4.0+dfsg-34:6.4.0+dfsg-3build14:6.4.0+dfsg-3ubuntu0.1~esm1 |
None known |
exactimageUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.2-31.0.2-5ubuntu11.0.2-5ubuntu21.0.2-7ubuntu11.0.2-7ubuntu2 |
None known |
kodiUbuntu:20.04:LTS |
All versions, plus listed versions 2:17.6+dfsg1-4ubuntu42:17.6+dfsg1-4ubuntu92:17.6+dfsg1-4ubuntu102:18.5+dfsg1-0ubuntu32:18.6+dfsg1-2ubuntu1 |
None known |
rawtherapeeUbuntu:20.04:LTS |
All versions, plus listed versions 5.6-15.7-15.8-1 |
None known |
darktableUbuntu:22.04:LTS |
All versions, plus listed versions 3.6.0-0ubuntu13.8.0-23.8.0-33.8.0-3build13.8.0-3build23.8.1-13.8.1-2 |
None known |
dcrawUbuntu:22.04:LTS |
All versions, plus listed versions 9.28-29.28-3 |
None known |
exactimageUbuntu:22.04:LTS |
All versions, plus listed versions 1.0.2-81.0.2-8build11.0.2-8build21.0.2-8build3 |
None known |
kodiUbuntu:22.04:LTS |
All versions, plus listed versions 2:19.1+dfsg2-22:19.3+dfsg1-12:19.3+dfsg1-1build22:19.3+dfsg1-1build32:19.3+dfsg1-1build42:19.3+dfsg1-1build52:19.4+dfsg1-2 |
None known |
librawUbuntu:22.04:LTS |
before 0.20.2-2ubuntu2.22.04.2, plus listed versions 0.20.2-1ubuntu30.20.2-2ubuntu10.20.2-2ubuntu20.20.2-2ubuntu2.22.04.1 |
0.20.2-2ubuntu2.22.04.2 |
rawtherapeeUbuntu:22.04:LTS |
All versions, plus listed versions 5.8-3 |
None known |
digikamUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4:7.1.0-24:7.1.0-2ubuntu14:7.4.0-0ubuntu14:7.5.0-0ubuntu14:7.5.0-3fakesync14:7.5.0-3ubuntu0.1~esm1 |
None known |
darktableUbuntu:24.04:LTS |
All versions, plus listed versions 4.4.2-1ubuntu14.4.2-1ubuntu24.4.2-1.14.4.2-1.1build14.6.1-24.6.1-2build34.6.1-2build44.6.1-2ubuntu1 |
None known |
dcrawUbuntu:24.04:LTS |
All versions, plus listed versions 9.28-39.28-3.1ubuntu19.28-5ubuntu1 |
None known |
digikamUbuntu:24.04:LTS |
All versions, plus listed versions 4:8.1.0-3fakesync14:8.2.0-0ubuntu14:8.2.0-0ubuntu44:8.2.0-0ubuntu54:8.2.0-0ubuntu64:8.2.0-0ubuntu6.2 |
None known |
exactimageUbuntu:24.04:LTS |
All versions, plus listed versions 1.0.2-11build21.0.2-11build31.0.2-11build41.0.2-11build71.0.2-11build81.0.2-11build9 |
None known |
kodiUbuntu:24.04:LTS |
All versions, plus listed versions 2:20.2+dfsg-42:20.2+dfsg-4build12:20.2+dfsg-4build22:20.2+dfsg-4ubuntu12:20.3+dfsg-12:20.4+dfsg-12:20.5+dfsg-1build22:20.5+dfsg-1ubuntu1 |
None known |
librawUbuntu:24.04:LTS |
before 0.21.2-2.1ubuntu0.24.04.1, plus listed versions 0.21.1-7ubuntu20.21.2-20.21.2-2.10.21.2-2.1build1 |
0.21.2-2.1ubuntu0.24.04.1 |
rawtherapeeUbuntu:24.04:LTS |
All versions, plus listed versions 5.9-1build15.9-25.10-15.10-1build35.10-1build4 |
None known |
darktableUbuntu:25.10 |
All versions, plus listed versions 5.0.1-0ubuntu15.0.1-0ubuntu25.0.1-15.0.1-2 |
None known |
dcrawUbuntu:25.10 |
All versions, plus listed versions 9.28-8 |
None known |
digikamUbuntu:25.10 |
All versions, plus listed versions 4:8.5.0-4ubuntu24:8.6.0-1ubuntu14:8.6.0-1ubuntu24:8.7.0-0ubuntu14:8.7.0-1ubuntu14:8.7.0-1ubuntu2 |
None known |
exactimageUbuntu:25.10 |
All versions, plus listed versions 1.2.1-2 |
None known |
kodiUbuntu:25.10 |
All versions, plus listed versions 2:21.2+dfsg-1build22:21.2+dfsg-42:21.2+dfsg-4build12:21.2+dfsg-4build2 |
None known |
rawtherapeeUbuntu:25.10 |
All versions, plus listed versions 5.11-2build2 |
None known |
darktableUbuntu:26.10 |
All versions, plus listed versions 5.4.1-15.4.1-1build15.4.1-1build2 |
None known |
dcrawUbuntu:26.10 |
All versions, plus listed versions 9.28-8build1 |
None known |
digikamUbuntu:26.10 |
All versions, plus listed versions 4:9.0.0-0ubuntu14:9.0.0-0ubuntu24:9.1.0-1ubuntu2 |
None known |
exactimageUbuntu:26.10 |
All versions, plus listed versions 1.2.1-2build21.2.1-3build11.2.1-3build2 |
None known |
kodiUbuntu:26.10 |
All versions, plus listed versions 2:21.3+dfsg-1ubuntu12:21.3+dfsg-1.2 |
None known |
rawtherapeeUbuntu:26.10 |
All versions, plus listed versions 5.12-25.12-2build1 |
None known |
darktableUbuntu:26.04:LTS |
All versions, plus listed versions 5.0.1-25.2.1-15.2.1-1build15.2.1-1build25.4.0-15.4.1-1 |
None known |
dcrawUbuntu:26.04:LTS |
All versions, plus listed versions 9.28-89.28-8build1 |
None known |
digikamUbuntu:26.04:LTS |
All versions, plus listed versions 4:8.7.0-1ubuntu24:8.8.0-1ubuntu14:8.8.0-2ubuntu14:8.8.0-2ubuntu34:8.8.0-2ubuntu44:9.0.0-0ubuntu1 |
None known |
exactimageUbuntu:26.04:LTS |
All versions, plus listed versions 1.2.1-21.2.1-2build11.2.1-2build2 |
None known |
kodiUbuntu:26.04:LTS |
All versions, plus listed versions 2:21.2+dfsg-4build22:21.2+dfsg-4build32:21.2+dfsg-52:21.3+dfsg-12:21.3+dfsg-1build12:21.3+dfsg-1ubuntu1 |
None known |
rawtherapeeUbuntu:26.04:LTS |
All versions, plus listed versions 5.11-2build25.12-15.12-2 |
None known |
librawUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 0.17.1-1ubuntu0.5+esm1, plus listed versions 0.16.2-10.17.0-10.17.1-10.17.1-1ubuntu0.10.17.1-1ubuntu0.20.17.1-1ubuntu0.30.17.1-1ubuntu0.40.17.1-1ubuntu0.5 |
0.17.1-1ubuntu0.5+esm1 |
librawUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 0.18.8-1ubuntu0.4+esm1, plus listed versions 0.18.2-20.18.5-10.18.7-20.18.8-10.18.8-1ubuntu0.10.18.8-1ubuntu0.20.18.8-1ubuntu0.30.18.8-1ubuntu0.4 |
0.18.8-1ubuntu0.4+esm1 |
librawUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 0.19.5-1ubuntu1.4, plus listed versions 0.19.5-10.19.5-1ubuntu10.19.5-1ubuntu1.10.19.5-1ubuntu1.20.19.5-1ubuntu1.3 |
0.19.5-1ubuntu1.4 |
librawUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 0.20.2-2ubuntu2.22.04.2, plus listed versions 0.20.2-1ubuntu30.20.2-2ubuntu10.20.2-2ubuntu20.20.2-2ubuntu2.22.04.1 |
0.20.2-2ubuntu2.22.04.2 |
librawUbuntu:24.04:LTS From an advisory covering 4 CVEs |
before 0.21.2-2.1ubuntu0.24.04.1, plus listed versions 0.21.1-7ubuntu20.21.2-20.21.2-2.10.21.2-2.1build1 |
0.21.2-2.1ubuntu0.24.04.1 |
librawopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.21.4-1.1 | 0.21.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-43963 is a low vulnerability (CVSS 2.9) in Libraw, published April 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in libraw 0.20.2-2.1+deb12u1.
References
libraw.org/news/libraw-0-21-4-release
github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4
lists.debian.org/debian-lts-announce/2025/04/msg00038.html
nvd.nist.gov/vuln/detail/CVE-2025-43963
Show 32 moreShow less
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785317741.html
security-tracker.debian.org/tracker/CVE-2025-43963
advisories.mageia.org/MGASA-2025-0316.html
bugs.mageia.org/show_bug.cgi?id=34221
lists.fedoraproject.org/archives/list/[email protected]/message/YDAIVZ4BSSDOYXE25CJ6Z7KXPOF4A6GL
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1478
suse.com/support/update/announcement/2025/suse-su-202501569-1
bugzilla.suse.com/1241584
ubuntu.com/security/CVE-2025-43963
cve.org/CVERecord?id=CVE-2025-43963