VULNERABILITY INTELLIGENCE

CVE-2018-5800

CVSS score6.5 MEDIUM

EPSS probability2.55%

CISA KEVNot currently listed

Published2018-12-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.

Weakness classification

CWE-193: Off-by-one Error
CWE-787: Out-of-bounds Write

Primary references

PSIRT-CNA@flexerasoftware.com — Third Party Advisory, VDB Entry
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
PSIRT-CNA@flexerasoftware.com — Release Notes
PSIRT-CNA@flexerasoftware.com — Patch, Vendor Advisory
PSIRT-CNA@flexerasoftware.com — Mailing List, Third Party Advisory
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory