CVE-2025-43964 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	2.9 LOW	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
mitre	CNA	2.9 LOW				CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 45%

Affected Products (NVD)

Vendor	Product	Version
libraw	libraw	𝑥 < 0.21.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libraw

bookworm	0.20.2-2.1+deb12u1 fixed
bullseye	vulnerable
bullseye (security)	0.20.2-1+deb11u2 fixed
forky	0.21.5b-1 fixed
sid	0.21.5b-1 fixed
trixie	0.21.4-2 fixed

Common Weakness Enumeration

CWE-1284 - Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References

https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0

https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4

https://www.libraw.org/news/libraw-0-21-4-release

https://lists.debian.org/debian-lts-announce/2025/04/msg00038.html