CVE-2026-88387: LibRaw TIFF Parser DoS Vulnerability

CVE-2026-88387 Overview

CVE-2026-88387 is an incorrect numeric conversion vulnerability [CWE-681] in LibRaw 0.22.0. The flaw resides in LibRaw::parse_tiff_ifd() during processing of TIFF tag 0x00fe (NewSubfileType). A crafted RAW, TIFF, or DNG file can supply a NewSubfileType value outside the range of a signed int. The parser narrows the attacker-controlled value to int without range validation, triggering undefined behavior and process termination. Exploitation requires local access and user interaction, such as opening a malicious image in an application that links LibRaw.

Critical Impact
A crafted image file causes applications using LibRaw 0.22.0 to abort, producing a denial-of-service condition in image viewers, RAW converters, and photo pipelines.

Affected Products

LibRaw 0.22.0
Applications and image processing pipelines that link against LibRaw 0.22.0
RAW, TIFF, and DNG parsers built on LibRaw metadata routines

Discovery Timeline

2026-09-24 - CVE-2026-88387 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-88387

Vulnerability Analysis

The vulnerability sits in src/metadata/tiff.cpp within LibRaw::parse_tiff_ifd(). When the parser reaches TIFF tag 0x00fe (NewSubfileType), it calls getreal(type) to decode the tag value and casts the result directly to int. The getreal() helper can return floating-point values when the TIFF tag type is LIBRAW_EXIFTAG_TYPE_FLOAT or LIBRAW_EXIFTAG_TYPE_DOUBLE. Converting a floating-point value that lies outside the representable range of int is undefined behavior under the C++ standard. On most compilers and platforms, this triggers an abort or sanitizer-detected fault, terminating the host process.

Root Cause

The root cause is missing type and range validation before narrowing conversion [CWE-681]. The original code trusts the TIFF tag type and performs int(getreal(type)) without rejecting floating-point types for a field that is defined as an unsigned integer by the TIFF specification. Attackers craft a TIFF directory entry declaring NewSubfileType as FLOAT or DOUBLE with a magnitude exceeding INT_MAX, causing the undefined conversion.

Attack Vector

An attacker delivers a malicious RAW, TIFF, or DNG file to a victim through email, file sharing, or a web download. When the victim opens the file in an application built on LibRaw 0.22.0, the parser hits the malformed NewSubfileType tag and the process aborts. The impact is limited to availability; the issue does not provide a path to arbitrary code execution or information disclosure.

cpp

       parse_tiff_ifd(base);
       break;
     case 0x00fe: /* NewSubfileType */
-      tiff_ifd[ifd].newsubfiletype = int(getreal(type));
+		if((type != LIBRAW_EXIFTAG_TYPE_FLOAT) && (type != LIBRAW_EXIFTAG_TYPE_DOUBLE))
+			tiff_ifd[ifd].newsubfiletype = int(getreal(type));
       break;
     case 0x0100: /* 256, ImageWidth */
     case 0xf001: /* 61441, Fuji RAF RawImageFullWidth */

Source: GitHub Commit b41cbbd. The patch validates the TIFF tag type and skips the narrowing conversion when the field is declared as FLOAT or DOUBLE.

Detection Methods for CVE-2026-88387

Indicators of Compromise

Repeated crashes of applications that process RAW, TIFF, or DNG files, with stack traces pointing to LibRaw::parse_tiff_ifd().
Core dumps or Windows Error Reporting entries referencing LibRaw 0.22.0 shortly after a user opens an image.
Image files with TIFF tag 0x00fe declared as type 11 (FLOAT) or 12 (DOUBLE) rather than the expected LONG.

Detection Strategies

Scan incoming image files with a TIFF-aware parser to flag NewSubfileType tags whose declared type is not an unsigned integer.
Monitor endpoint telemetry for abnormal process terminations in image viewers, photo editors, and batch RAW processors.
Correlate file-open events with subsequent process crashes to identify weaponized images delivered via email or shared storage.

Monitoring Recommendations

Enable crash reporting across workstations that handle photographic workflows and route reports to a central analytics platform.
Track software inventory for LibRaw 0.22.0 and dependent applications across engineering, media, and content production hosts.
Alert on bulk delivery of RAW, TIFF, or DNG attachments from untrusted senders, especially in environments without the patch.

How to Mitigate CVE-2026-88387

Immediate Actions Required

Upgrade LibRaw to a release that includes commit b41cbbd or later and rebuild all dependent applications.
Inventory internal tools, plugins, and third-party software that bundle LibRaw 0.22.0 and schedule updates with each vendor.
Restrict handling of untrusted RAW, TIFF, and DNG files until patched builds are deployed.

Patch Information

The upstream fix is published in commit b41cbbd61951783e0440590dae55411a16185bdf on the LibRaw repository, tracked through GitHub Issue #844 and merged via GitHub Pull Request #853. The patch gates the narrowing conversion on the TIFF tag type, rejecting FLOAT and DOUBLE values for NewSubfileType.

Workarounds

Open RAW, TIFF, and DNG files only from trusted sources until patched LibRaw builds are rolled out.
Process untrusted images inside sandboxed or containerized environments that isolate crashes from production workflows.
Pre-filter inbound image files with a validator that rejects NewSubfileType tags declared as floating-point types.

bash

# Rebuild LibRaw from source after applying the upstream patch
git clone https://github.com/LibRaw/LibRaw.git
cd LibRaw
git checkout b41cbbd61951783e0440590dae55411a16185bdf
autoreconf -fi
./configure --prefix=/usr/local
make -j"$(nproc)"
sudo make install
sudo ldconfig