TI-2026-75054 Aliases CVE-2026-111272

Heap out-of-bounds read in LibRaw Nikon ShotInfo parsing

LOW 29CWE-125Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

LibRaw through 0.22.2 contains a heap-based out-of-bounds read (CWE-125) in LibRaw::parseNikonMakernote() that lets attackers read past a short ShotInfo buffer. An attacker supplies a crafted Nikon NEF or TIFF file with a 5-byte ShotInfo tag declaring version 243, which crashes applications that decode the image.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00128 2nd percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LibRaw	LibRaw	up to 0.22.2	—	No fix listed	CNA

LibRaw VendorLibRaw Affected up to 0.22.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:libraw:libraw::::::::	—	—	LibRaw

cpe:2.3:a:libraw:libraw:*:*:*:*:*:*:*:* Versions — — ·LibRaw

Remediation

The sources list no fixed version for LibRaw. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 as affected, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Not affected: 3 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Timeline

2026-10-16 Threatist record created from CVE-2026-111272
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-16 CISA SSVC decision points changed

References

Other 3

TI-2026-04674 LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds CVSS 4.0MEDIUM 6.9
TI-2020-14361 Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspect_ratio.cpp. CVSS 3.1MEDIUM 6.5
TI-2026-04650 LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write CVSS 4.0MEDIUM 5.3
TI-2015-06888 The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory… CVSS 3.1CRITICAL 9.8
TI-2026-16934 A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality… CVSS 3.1CRITICAL 9.8
TI-2026-16915 Integer overflow in LibRaw CVSS 3.1CRITICAL 9.8

See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences