CVE-2026-111272: LibRaw Heap Buffer Overflow Vulnerability

CVE-2026-111272 Overview

CVE-2026-111272 is a heap-based out-of-bounds read [CWE-125] in LibRaw versions through 0.22.2. The flaw resides in the LibRaw::parseNikonMakernote() function, which processes Nikon-specific metadata embedded in NEF and TIFF image files. An attacker can craft a Nikon image containing a 5-byte ShotInfo tag that declares version 243, causing the parser to read past the end of a short ShotInfo buffer on the heap. Applications that use LibRaw to decode untrusted images will crash when processing the malicious file, resulting in denial of service.

Critical Impact
A crafted Nikon raw image triggers an out-of-bounds heap read in parseNikonMakernote(), crashing any application that uses LibRaw to decode the file.

Affected Products

LibRaw through version 0.22.2
Applications and image viewers that embed LibRaw for Nikon NEF decoding
Downstream libraries bundling LibRaw for raw image processing

Discovery Timeline

2026-10-15 - CVE-2026-111272 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111272

Vulnerability Analysis

LibRaw is a widely used open-source library for decoding camera raw image formats. The parseNikonMakernote() function in src/metadata/nikon.cpp handles Nikon-specific MakerNote tags, including the ShotInfo structure that stores shooting parameters.

When the parser encounters a ShotInfo tag, it reads the first bytes to identify a version number and then dispatches to version-specific handling logic. For version 243, the parser assumes a larger buffer and attempts to read fields such as OrientationOffset from offsets beyond the declared tag length. Supplying only 5 bytes while declaring version 243 forces the function to dereference memory past the heap allocation, producing an out-of-bounds read.

The condition is reachable from any Nikon-format image fed to a LibRaw consumer, with no authentication required by the library itself.

Root Cause

The root cause is missing bounds validation between the declared ShotInfo version and the actual tag size supplied in the image metadata. The code trusts the version field to imply a specific layout and length, then indexes into the buffer accordingly. Because the attacker controls both the version value and the tag length, the parser can be steered into reading beyond the allocated heap region.

Attack Vector

Exploitation requires a user to open or process a crafted Nikon NEF or TIFF file with an application that links against LibRaw. The attack vector is local and depends on user interaction, such as previewing an image in a file manager, thumbnailing a shared directory, or batch-converting raw images. Successful triggering results in a crash of the host application. The out-of-bounds read may also leak adjacent heap memory into derived outputs when the parsed values influence downstream processing.

For code-level context, see the LibRaw Nikon Metadata Code and the HackMD LibRaw OOB Read Analysis.

Detection Methods for CVE-2026-111272

Indicators of Compromise

Nikon NEF or TIFF files containing a ShotInfo MakerNote tag of exactly 5 bytes while declaring version 243.
Repeated crashes or segmentation faults in applications or services that invoke LibRaw during image parsing.
Thumbnailer, indexer, or image-conversion processes terminating unexpectedly when scanning user-supplied raw images.

Detection Strategies

Inspect inbound image files for malformed Nikon MakerNote structures using an EXIF/MakerNote-aware parser before handing them to LibRaw.
Monitor crash telemetry and core dumps from applications that depend on LibRaw, correlating with recent raw file ingestion.
Audit software bills of materials (SBOM) to enumerate products that embed LibRaw at or below version 0.22.2.

Monitoring Recommendations

Enable Address Sanitizer (ASan) in development and QA pipelines to catch out-of-bounds reads in LibRaw-dependent builds.
Forward application crash logs and Windows Error Reporting or Linux coredumpctl events to a central SIEM for correlation.
Track file-ingestion endpoints that accept raw image uploads for anomalous crash-to-upload ratios.

How to Mitigate CVE-2026-111272

Immediate Actions Required

Identify all applications and services linking against LibRaw 0.22.2 or earlier and prioritize those exposed to user-supplied images.
Restrict parsing of untrusted Nikon NEF and TIFF files until a patched LibRaw build is deployed.
Disable automatic thumbnail generation and background indexing for shared or externally sourced image directories.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the LibRaw GitHub Repository and the VulnCheck LibRaw Advisory for a patched release addressing parseNikonMakernote() bounds handling, and rebuild downstream software against the fixed library once available.

Workarounds

Sandbox image-parsing workloads using containers, seccomp profiles, or dedicated low-privilege service accounts to contain crashes.
Pre-filter raw files by validating MakerNote tag sizes against expected structure versions before invoking LibRaw.
Convert untrusted raw images to a safer intermediate format using an isolated converter running on disposable infrastructure.

bash

# Example: run a LibRaw-based converter inside a restrictive sandbox
firejail --noprofile --net=none --private-tmp \
  --read-only=/usr --caps.drop=all --nonewprivs \
  dcraw_emu -T -w /mnt/untrusted/input.NEF