CVE-2025-43964 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	2.9 LOW	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 32.73%

Affected Products (NVD)

Vendor	Product	Version
libraw	libraw	𝑥 < 0.21.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libraw

bookworm	0.20.2-2.1+deb12u1 fixed
bookworm (security)	0.20.2-2.1+deb12u2 fixed
forky	0.22.1-1 fixed
sid	0.22.1-1 fixed
trixie	0.21.4-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

ufraw

bionic	needs-triage
focal	dne
jammy	dne
noble	dne
oracular	dne
questing	dne
resolute	dne
xenial	needs-triage

darktable

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage
xenial	needs-triage

exactimage

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage
xenial	needs-triage

dcraw

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage
xenial	needs-triage

rawtherapee

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage
xenial	needs-triage

kodi

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage
xenial	needs-triage

digikam

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage
xenial	needs-triage

libraw

bionic	Fixed 0.18.8-1ubuntu0.4+esm1 released
focal	Fixed 0.19.5-1ubuntu1.4 released
jammy	Fixed 0.20.2-2ubuntu2.22.04.2 released
noble	Fixed 0.21.2-2.1ubuntu0.24.04.1 released
oracular	Fixed 0.21.2-2.1ubuntu0.24.10.1 released
plucky	Fixed 0.21.3-1ubuntu0.25.04.1 released
questing	not-affected
resolute	not-affected
xenial	Fixed 0.17.1-1ubuntu0.5+esm1 released

openSUSE / SLES Releases

openSUSE Product

Release

libraw-devel

suse enterprise desktop 15 SP6	0.21.1-150600.3.5.1 fixed
suse enterprise desktop 15 SP7	0.21.1-150600.3.5.1 fixed
suse enterprise sap 15 SP6	0.21.1-150600.3.5.1 fixed
suse enterprise sap 15 SP7	0.21.1-150600.3.5.1 fixed
suse enterprise server 15 SP6	0.21.1-150600.3.5.1 fixed
suse enterprise server 15 SP7	0.21.1-150600.3.5.1 fixed
suse enterprise workstation 15 SP6	0.21.1-150600.3.5.1 fixed
suse enterprise workstation 15 SP7	0.21.1-150600.3.5.1 fixed

libraw16

suse enterprise desktop 15 SP6	0.18.9-150000.3.30.1 fixed
suse enterprise desktop 15 SP7	0.18.9-150000.3.30.1 fixed
suse enterprise sap 15 SP6	0.18.9-150000.3.30.1 fixed
suse enterprise sap 15 SP7	0.18.9-150000.3.30.1 fixed
suse enterprise server 15 SP6	0.18.9-150000.3.30.1 fixed
suse enterprise server 15 SP7	0.18.9-150000.3.30.1 fixed
suse enterprise workstation 15 SP6	0.18.9-150000.3.30.1 fixed
suse enterprise workstation 15 SP7	0.18.9-150000.3.30.1 fixed

Amazon Linux Releases

Amazon Package

Release

LibRaw

Amazon Linux 2

0:0.19.4-1.amzn2.0.3

fixed

LibRaw-debuginfo

Amazon Linux 2

0:0.19.4-1.amzn2.0.3

fixed

LibRaw-devel

Amazon Linux 2

0:0.19.4-1.amzn2.0.3

fixed

LibRaw-static

Amazon Linux 2

0:0.19.4-1.amzn2.0.3

fixed

Common Weakness Enumeration

CWE-1284 - Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References

https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0

https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4

https://www.libraw.org/news/libraw-0-21-4-release

https://lists.debian.org/debian-lts-announce/2025/04/msg00038.html