CVE-2025-43961: LibRaw Out-of-Bounds Read Vulnerability

CVE-2025-43961 Overview

CVE-2025-43961 is an out-of-bounds read vulnerability discovered in LibRaw, a widely-used library for reading RAW image files from digital cameras. The vulnerability exists in metadata/tiff.cpp within the Fujifilm 0xf00c tag parser. When processing specially crafted RAW image files, the parser fails to properly validate buffer boundaries, allowing attackers to read memory beyond allocated bounds. This can lead to sensitive information disclosure or application crashes.

Critical Impact
This vulnerability can be exploited remotely without authentication by tricking users into processing malicious RAW image files, potentially exposing sensitive memory contents or causing denial of service through application crashes.

Affected Products

LibRaw versions prior to 0.21.4
Applications and software utilizing LibRaw for RAW image processing
Linux distributions including Debian that ship vulnerable LibRaw packages

Discovery Timeline

2025-02-05 - Security fix committed by Alex Tutubalin
2025-04-21 - CVE CVE-2025-43961 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-43961

Vulnerability Analysis

This vulnerability represents a classic out-of-bounds read condition (CWE-125) in the LibRaw image processing library. The flaw resides in the Fujifilm white balance table parsing functionality, specifically when handling the 0xf00c tag in TIFF metadata structures. The parser calculates buffer offsets using values derived from image header data without adequate bounds checking, enabling reads past allocated buffer boundaries.

The vulnerability can be exploited remotely through network-accessible applications that process user-supplied RAW image files. No authentication or user privileges are required for exploitation, making this particularly dangerous for web applications, image galleries, and content management systems that automatically process uploaded images.

Root Cause

The root cause lies in insufficient validation of array indices and computed buffer sizes in the Fujifilm white balance (WB) table parsing code. When parsing the 0xf00c tag, the library reads header values that determine array dimensions (head[1], head[2], head[3], head[4]). These values are multiplied to compute buffer sizes without checking whether the resulting products exceed reasonable limits, leading to potential one-off read errors and out-of-bounds memory access.

Attack Vector

The attack vector is network-based, requiring an attacker to craft a malicious RAW image file with specially manipulated Fujifilm metadata tags. When a vulnerable application processes this file—whether through direct file upload, email attachment processing, or automated image indexing—the out-of-bounds read is triggered. The attacker does not require any prior authentication or special privileges, making this vulnerability accessible for exploitation in any context where LibRaw processes untrusted image data.

cpp

// Security patch - Added bounds validation in src/decoders/load_mfbacks.cpp
       fseek(ifp, off_412, SEEK_SET);
       for (i = 0; i < 9; i++)
         head[i] = get4() & 0x7fff;
	  unsigned w0 = head[1] * head[3], w1 = head[2] * head[4];
	  if (w0 > 10240000 || w1 > 10240000)
		  throw LIBRAW_EXCEPTION_ALLOC;
       yval[0] = (float *)calloc(head[1] * head[3] + head[2] * head[4], 6);
       yval[1] = (float *)(yval[0] + head[1] * head[3]);
       xval[0] = (ushort *)(yval[1] + head[2] * head[4]);

Source: GitHub Commit

Detection Methods for CVE-2025-43961

Indicators of Compromise

Unexpected application crashes or segmentation faults when processing RAW image files, particularly Fujifilm formats
Abnormal memory access patterns or memory dump events associated with image processing operations
High volume of RAW image uploads from suspicious sources targeting image processing endpoints
Application logs showing LibRaw exceptions or errors related to TIFF metadata parsing

Detection Strategies

Implement file integrity monitoring on LibRaw library files to detect unauthorized modifications
Deploy memory protection mechanisms (ASLR, DEP/NX) to limit exploitability of out-of-bounds reads
Monitor application behavior for abnormal memory access patterns during image processing operations
Utilize vulnerability scanners to identify LibRaw versions prior to 0.21.4 across the environment

Monitoring Recommendations

Enable verbose logging for image processing applications to capture parsing errors and exceptions
Implement network traffic analysis to detect unusually large or malformed RAW image file transfers
Set up alerting for repeated crashes or restarts of services that utilize LibRaw for image processing
Monitor for unusual process memory access patterns using endpoint detection and response (EDR) solutions

How to Mitigate CVE-2025-43961

Immediate Actions Required

Upgrade LibRaw to version 0.21.4 or later immediately across all affected systems
Temporarily disable automatic processing of untrusted RAW image files if patching cannot be performed immediately
Review and audit all applications and services that depend on LibRaw for image processing
Implement input validation to filter or quarantine RAW files from untrusted sources until patching is complete

Patch Information

The vulnerability has been addressed in LibRaw version 0.21.4. The fix introduces explicit bounds checking for computed buffer sizes in the Fujifilm white balance table parsing code, throwing a LIBRAW_EXCEPTION_ALLOC exception when calculated dimensions exceed 10,240,000 elements. The patch is available through the official LibRaw 0.21.4 release and the GitHub commit 66fe663. Debian users should refer to the Debian LTS Security Notice for distribution-specific updates.

Workarounds

Restrict image processing to trusted file sources only until the patch can be applied
Implement sandboxing for image processing applications to limit the impact of potential exploitation
Use container isolation for services that handle RAW image processing from external sources
Deploy web application firewalls (WAF) with file type validation to block suspicious RAW uploads

bash

# Configuration example - Check and update LibRaw version on Linux systems
# Check current LibRaw version
pkg-config --modversion libraw

# Update via package manager (Debian/Ubuntu)
sudo apt update && sudo apt upgrade libraw-dev libraw20

# Verify updated version (should be 0.21.4 or higher)
pkg-config --modversion libraw