LibRaw uncompressed_fp_dng_load_raw integer overflow vulnerability

An integer overflow vulnerability has been identified in the LibRaw library, specifically within the uncompressed_fp_dng_load_raw function. This flaw could potentially allow an attacker to trigger unexpected behavior or, in some cases, lead to arbitrary code execution by crafting a malicious DNG (Digital Negative) raw image file.

Technical Breakdown:

• Vulnerability Type: Integer Overflow
• Affected Component: LibRaw library, specifically the uncompressed_fp_dng_load_raw function, which handles uncompressed floating-point DNG raw image data.
• Impact: Integer overflows can lead to memory corruption, denial of service, or potentially arbitrary code execution if an attacker can control subsequent memory operations.
• Vector: Processing a specially crafted DNG file.

Defense: Update LibRaw to the latest patched version to mitigate this vulnerability. Implement robust input validation for files processed by image libraries.

Source: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363