{"id":"CVE-2025-43963","aliases":["AZL-61810","CLSA-2026-1785317741","CLSA-2026-1785408515","DEBIAN-CVE-2025-43963","DLA-4142-1","EUVD-2025-11960","GHSA-3w5w-m35v-rfp7","JLSEC-2026-1111","MGASA-2025-0316","OESA-2025-1478","SUSE-SU-2025:01569-1","SUSE-SU-2025:01572-1","SUSE-SU-2025:1568-1","SUSE-SU-2025:1569-1","SUSE-SU-2025:1572-1","UBUNTU-CVE-2025-43963","USN-7485-1","openSUSE-SU-2025:15025-1"],"status":"published","title":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00448,"percentile":0.39226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-04-20T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"libraw","fixed_in":["0.20.2-2.1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libraw","fixed_in":["0.21.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libraw","fixed_in":["0.21.4-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibRaw_jll","fixed_in":["0.22.1+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libraw","fixed_in":["0.17.1-1ubuntu0.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libraw","fixed_in":["0.18.8-1ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libraw","fixed_in":["0.19.5-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libraw","fixed_in":["0.20.2-2ubuntu2.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libraw","fixed_in":["0.21.2-2.1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.3-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-1.el9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"LibRaw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-1.el9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"LibRaw-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-1.el9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"LibRaw-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-1.el9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-5.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"LibRaw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-5.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"LibRaw-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-5.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"LibRaw-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-5.el9_2.tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-2.1+deb12u1"}]}],"versions":["0.20.2-2.1"]},{"source":"osv","ecosystem":"Debian:13","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-1+deb11u2"}]}],"versions":["0.20.2-1","0.20.2-1+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Julia","package":"LibRaw_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-5.1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-1.1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1.2.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-4.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-4.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-8.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-9.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"LibRaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-9.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.9-150000.3.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.9-150000.3.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-150600.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.1-1ubuntu0.5+esm1"}]}],"versions":["0.16.2-1","0.17.0-1","0.17.1-1","0.17.1-1ubuntu0.1","0.17.1-1ubuntu0.2","0.17.1-1ubuntu0.3","0.17.1-1ubuntu0.4","0.17.1-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.8-1","1.6.9-1","2.0.0-1","2.0.1-1","2.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.21-0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.12.0-0ubuntu5","4:4.12.0-0ubuntu6","4:4.12.0-0ubuntu7","4:4.12.0-0ubuntu7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-6build1","0.9.1-6ubuntu1","0.9.1-8ubuntu1","0.9.1-9","0.9.1-9build1","0.9.1-10","0.9.1-11","0.9.1-12","0.9.1-12ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.1+dfsg1-3","15.2+dfsg1-1build1","15.2+dfsg1-3","15.2+dfsg1-3ubuntu1","15.2+dfsg1-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2-2build1","4.2-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.8-1ubuntu0.4+esm1"}]}],"versions":["0.18.2-2","0.18.5-1","0.18.7-2","0.18.8-1","0.18.8-1ubuntu0.1","0.18.8-1ubuntu0.2","0.18.8-1ubuntu0.3","0.18.8-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5-2","2.4.0-1","2.4.1-1","2.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.27-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.6.0-0ubuntu2","4:5.6.0-0ubuntu3","4:5.6.0-0ubuntu4","4:5.6.0-0ubuntu7","4:5.6.0-0ubuntu8","4:5.6.0-0ubuntu9","4:5.6.0-0ubuntu10","4:5.6.0-0ubuntu10+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1build1","1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.3+dfsg1-3","2:17.3+dfsg1-3build1","2:17.3+dfsg1-5","2:17.3+dfsg1-5build1","2:17.3+dfsg1-5build2","2:17.6+dfsg1-1","2:17.6+dfsg1-1build1","2:17.6+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-1","5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22-1.1","0.22-2","0.22-3","0.22-3.1~build0.18.04.1","0.22-3.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.5-1ubuntu1.4"}]}],"versions":["0.19.5-1","0.19.5-1ubuntu1","0.19.5-1ubuntu1.1","0.19.5-1ubuntu1.2","0.19.5-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.2-3","2.6.3-1","2.6.3-1build1","2.6.3-1build2","3.0.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:5.9.0-1ubuntu4","4:6.4.0+dfsg-3","4:6.4.0+dfsg-3build1","4:6.4.0+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-3","1.0.2-5ubuntu1","1.0.2-5ubuntu2","1.0.2-7ubuntu1","1.0.2-7ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.6+dfsg1-4ubuntu4","2:17.6+dfsg1-4ubuntu9","2:17.6+dfsg1-4ubuntu10","2:18.5+dfsg1-0ubuntu3","2:18.6+dfsg1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6-1","5.7-1","5.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.0-0ubuntu1","3.8.0-2","3.8.0-3","3.8.0-3build1","3.8.0-3build2","3.8.1-1","3.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-2","9.28-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-8","1.0.2-8build1","1.0.2-8build2","1.0.2-8build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:19.1+dfsg2-2","2:19.3+dfsg1-1","2:19.3+dfsg1-1build2","2:19.3+dfsg1-1build3","2:19.3+dfsg1-1build4","2:19.3+dfsg1-1build5","2:19.4+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-2ubuntu2.22.04.2"}]}],"versions":["0.20.2-1ubuntu3","0.20.2-2ubuntu1","0.20.2-2ubuntu2","0.20.2-2ubuntu2.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:7.1.0-2","4:7.1.0-2ubuntu1","4:7.4.0-0ubuntu1","4:7.5.0-0ubuntu1","4:7.5.0-3fakesync1","4:7.5.0-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.2-1ubuntu1","4.4.2-1ubuntu2","4.4.2-1.1","4.4.2-1.1build1","4.6.1-2","4.6.1-2build3","4.6.1-2build4","4.6.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-3","9.28-3.1ubuntu1","9.28-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:8.1.0-3fakesync1","4:8.2.0-0ubuntu1","4:8.2.0-0ubuntu4","4:8.2.0-0ubuntu5","4:8.2.0-0ubuntu6","4:8.2.0-0ubuntu6.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-11build2","1.0.2-11build3","1.0.2-11build4","1.0.2-11build7","1.0.2-11build8","1.0.2-11build9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:20.2+dfsg-4","2:20.2+dfsg-4build1","2:20.2+dfsg-4build2","2:20.2+dfsg-4ubuntu1","2:20.3+dfsg-1","2:20.4+dfsg-1","2:20.5+dfsg-1build2","2:20.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.2-2.1ubuntu0.24.04.1"}]}],"versions":["0.21.1-7ubuntu2","0.21.2-2","0.21.2-2.1","0.21.2-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9-1build1","5.9-2","5.10-1","5.10-1build3","5.10-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-0ubuntu1","5.0.1-0ubuntu2","5.0.1-1","5.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:8.5.0-4ubuntu2","4:8.6.0-1ubuntu1","4:8.6.0-1ubuntu2","4:8.7.0-0ubuntu1","4:8.7.0-1ubuntu1","4:8.7.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-1build2","2:21.2+dfsg-4","2:21.2+dfsg-4build1","2:21.2+dfsg-4build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.1-1","5.4.1-1build1","5.4.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:9.0.0-0ubuntu1","4:9.0.0-0ubuntu2","4:9.1.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2build2","1.2.1-3build1","1.2.1-3build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.3+dfsg-1ubuntu1","2:21.3+dfsg-1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12-2","5.12-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-2","5.2.1-1","5.2.1-1build1","5.2.1-1build2","5.4.0-1","5.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8","9.28-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:8.7.0-1ubuntu2","4:8.8.0-1ubuntu1","4:8.8.0-2ubuntu1","4:8.8.0-2ubuntu3","4:8.8.0-2ubuntu4","4:9.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2","1.2.1-2build1","1.2.1-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-4build2","2:21.2+dfsg-4build3","2:21.2+dfsg-5","2:21.3+dfsg-1","2:21.3+dfsg-1build1","2:21.3+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2","5.12-1","5.12-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.1-1ubuntu0.5+esm1"}]}],"versions":["0.16.2-1","0.17.0-1","0.17.1-1","0.17.1-1ubuntu0.1","0.17.1-1ubuntu0.2","0.17.1-1ubuntu0.3","0.17.1-1ubuntu0.4","0.17.1-1ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.8-1ubuntu0.4+esm1"}]}],"versions":["0.18.2-2","0.18.5-1","0.18.7-2","0.18.8-1","0.18.8-1ubuntu0.1","0.18.8-1ubuntu0.2","0.18.8-1ubuntu0.3","0.18.8-1ubuntu0.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.5-1ubuntu1.4"}]}],"versions":["0.19.5-1","0.19.5-1ubuntu1","0.19.5-1ubuntu1.1","0.19.5-1ubuntu1.2","0.19.5-1ubuntu1.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-2ubuntu2.22.04.2"}]}],"versions":["0.20.2-1ubuntu3","0.20.2-2ubuntu1","0.20.2-2ubuntu2","0.20.2-2ubuntu2.22.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.2-2.1ubuntu0.24.04.1"}]}],"versions":["0.21.1-7ubuntu2","0.21.2-2","0.21.2-2.1","0.21.2-2.1build1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.4-1.1"}]}],"bundled":4}],"products":[{"vendor":"libraw","product":"libraw"}],"references":[{"url":"https://www.libraw.org/news/libraw-0-21-4-release","tags":["Release Notes","web","report"]},{"url":"https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4","tags":["Patch","Release Notes","web","report"]},{"url":"https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964","tags":["Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00038.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43963","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3w5w-m35v-rfp7","tags":["web"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785317741.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43964","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785408515.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43963.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-43963","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34221","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDAIVZ4BSSDOYXE25CJ6Z7KXPOF4A6GL/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMNI4GAUYVWHWJ2MPCIEMWUBTIM32E2H/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3I3BWKSTHKFJDS7ZRYZSMCPXZLSPJKIW/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1478","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501569-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241584","tags":["report"]},{"url":"https://bugzilla.suse.com/1241585","tags":["report"]},{"url":"https://bugzilla.suse.com/1241642","tags":["report"]},{"url":"https://bugzilla.suse.com/1241643","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43964","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501572-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251568-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251569-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251572-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-43963","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-43963","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7485-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-43961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-43962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-43964","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-43963","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-20T00:00:00Z","modified":"2025-11-03T20:04:10.173Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:26.964524Z"}],"euvd":[{"id":"EUVD-2025-11960","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-20T00:00:00Z","modified":"2025-11-03T20:04:10Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-3w5w-m35v-rfp7","title":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-21T00:30:19Z","modified":"2025-11-03T21:34:44Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:24.938946Z"}],"nvd":[{"id":"CVE-2025-43963","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-21T00:15:33.173Z","modified":"2026-06-17T09:24:49.973Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:11:01.507281Z"}],"osv":[{"id":"AZL-61810","title":"CVE-2025-43963 affecting package LibRaw 0.21.3-1","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-21T00:15:33Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CVE-2025-43963","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-20T00:00:00Z","modified":"2026-10-28T11:01:40.463521455Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-43963","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-21T00:15:33.173Z","modified":"2026-09-01T20:05:52.607426795Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-1111","title":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...","description":"In LibRaw before 0.21.4, `phase_one_correct` in `decoders/load_mfbacks.cpp` allows out-of-buffer access because `split_col` and `split_row` values are not checked in 0x041f tag processing.","status":"published","published":"2026-08-03T14:05:55.614Z","modified":"2026-08-03T14:20:51.293424348Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2025-1478","title":"LibRaw security update","description":"LibRaw is a library for reading RAW files from digital photo cameras (CRW/CR2, NEF, RAF, etc, virtually all RAW formats are supported).It pays special attention to correct retrieval of data required for subsequent RAW conversion.The library is intended for embedding in RAW converters, data analyzers, and other programs using RAW files as the initial data.\r\n\r\nSecurity Fix(es):\n\nIn LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.(CVE-2025-43961)\n\nIn LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.(CVE-2025-43962)\n\nIn LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.(CVE-2025-43963)\n\nIn LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.(CVE-2025-43964)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:17:52.289562231Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-43963","description":"In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.","status":"published","published":"2025-04-21T00:15:00Z","modified":"2026-10-17T12:56:51.726920573Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CLSA-2026-1785317741","title":"LibRaw: Fix of 4 CVEs","description":"- CVE-2025-43961 CVE-2025-43962 CVE-2025-43963 CVE-2025-43964: fix\n  out-of-bounds reads in the Phase One / Fujifilm metadata decoders\n  (phase_one_correct / fuji 0xf00c); backport upstream 0.21.4 fixes","status":"published","published":"2026-07-29T09:35:54Z","modified":"2026-10-26T09:31:22.329727126Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785408515","title":"LibRaw: Fix of 4 CVEs","description":"- CVE-2025-43961 CVE-2025-43962 CVE-2025-43963 CVE-2025-43964: fix\n  out-of-bounds reads in the Phase One / Fujifilm metadata decoders\n  (phase_one_correct / fuji 0xf00c); backport upstream 0.21.4 fixes","status":"published","published":"2026-07-30T10:48:48Z","modified":"2026-10-26T09:30:28.39380776Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"DLA-4142-1","title":"libraw - security update","status":"published","published":"2025-04-29T00:00:00Z","modified":"2026-03-09T01:23:14.002668Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0316","title":"Updated libraw, digikam \u0026 darktable packages fix security vulnerabilities","description":"In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in\nthe Fujifilm 0xf00c tag parser. (CVE-2025-43961)\nIn LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp\nhas out-of-bounds reads for tag 0x412 processing, related to large w0 or\nw1 values or the frac and mult calculations. (CVE-2025-43962)\nIn LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp\nallows out-of-buffer access because split_col and split_row values are\nnot checked in 0x041f tag processing. (CVE-2025-43963)\nIn LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in\ndecoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.\n(CVE-2025-43964)\n","status":"published","published":"2025-12-04T23:29:13Z","modified":"2026-04-16T04:41:45.534953637Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15025-1","title":"libraw-devel-0.21.4-1.1 on GA media","description":"These are all security issues fixed in the libraw-devel-0.21.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-24T00:00:00Z","modified":"2025-05-07T18:16:52.059836Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:01569-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)\n- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)\n- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)\n- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct  does not enforce minimum w0 and w1 values (bsc#1241584)\n","status":"published","published":"2025-06-06T13:12:49Z","modified":"2026-02-04T04:19:27.421646Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01572-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)\n- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)\n- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)\n- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct  does not enforce minimum w0 and w1 values (bsc#1241584)\n","status":"published","published":"2025-06-06T13:12:42Z","modified":"2026-02-04T04:09:41.077478Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:1568-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)\n- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)\n- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)\n- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct  does not enforce minimum w0 and w1 values (bsc#1241584)\n","status":"published","published":"2025-05-16T13:42:49Z","modified":"2026-02-04T02:29:54.001353Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1569-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)\n- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)\n- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)\n- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct  does not enforce minimum w0 and w1 values (bsc#1241584)\n","status":"published","published":"2025-05-16T13:43:41Z","modified":"2026-02-04T04:40:22.137099Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1572-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n- CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp (bsc#1241643)\n- CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)\n- CVE-2025-43963: Fixed out-of-buffer access during phase_one_correct in decoders/load_mfbacks.cpp (bsc#1241642)\n- CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct  does not enforce minimum w0 and w1 values (bsc#1241584)\n","status":"published","published":"2025-05-16T14:07:06Z","modified":"2025-05-22T10:59:11.133763Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7485-1","title":"libraw vulnerabilities","description":"It was discovered that LibRaw could be made to read out of bounds. An\nattacker could possibly use this issue to cause applications using LibRaw\nto crash, resulting in a denial of service. (CVE-2025-43961,\nCVE-2025-43962, CVE-2025-43963, CVE-2025-43964)\n","status":"published","published":"2025-05-06T06:56:55Z","modified":"2026-06-25T13:32:30.351132544Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}