Signals
Back to database
Schedule30Medium5.5VulnerabilityCVE-2026-88387No patch link observed

CVE-2026-88387 — LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType).

Published Sep 24, 2026, 09:18 PM UTCIngested 14d agoSource NVD(cve-db)CVE-2026-88387

Description

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.

CVSS v3.1 base metrics

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
5.5

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Local

Attack Vector

AC

Low

Attack Complexity

PR

None

Privileges Required

UI

Required

User Interaction

S

Unchanged

Scope

C

None

Confidentiality

I

None

Integrity

A

High

Availability

References

Related threats

same CWE or vendor
Low

CVE-2026-106432 — The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation.

CVE-2026-106432 · 3h ago

Medium

CVE-2026-107224 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.

CVE-2026-107224 · 1d ago

Medium

CVE-2026-47539 — NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect numeric conv…

CVE-2026-47539 · 8d ago

High

CVE-2026-47508 — NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect conversion…

CVE-2026-47508 · 8d ago

Medium

CVE-2026-98049 — In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_access…

CVE-2026-98049 · 14d ago

Medium

CVE-2026-88367 — NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization.

CVE-2026-88367 · 14d ago