CVE-2018-5809 — LibRaw: stack-based buffer overflow in LibRaw::parse_exif() and subsequently execute arbitrary code

Back Back to CVE browser

HIGH

LibRaw: stack-based buffer overflow in LibRaw::parse_exif() and subsequently execute arbitrary code

Published Dec 7, 2018

8.8

HIGH

CVSS 3.0

EPSS 2.79%

Description

An error within the "LibRaw::parse_exif()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.

Affected products

Vendor n/a Product LibRaw Default
n/a
- Version
  Prior to 0.18.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

LibRaw

n/a

Version	Status	Constraints
Prior to 0.18.9	affected	-

Red Hat Enterprise Linux 7

LibRaw

Not affected
Red Hat Enterprise Linux 8

LibRaw

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	LibRaw	Not affected	n/a
Red Hat Enterprise Linux 8	LibRaw	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of LibRaw as shipped with Red Hat Enterprise Linux 7 as the vulnerable code is not present.

Metrics

2.79% 0.02786

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02786

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.79% (0.02786)	85.90th	v5 (v2026.06.15)
Jun 15, 2026	2.79% (0.02786)	84.49th	v5 (v2026.06.15)
Mar 30, 2025	2.21% (0.02209)	82.97th	v4 (v2025.03.14)
Mar 29, 2025	5.31% (0.05310)	83.03th	v4 (v2025.03.14)
Jul 20, 2024	1.10% (0.01098)	84.59th	v3 (v2023.03.01)
Jun 8, 2024	1.10% (0.01098)	84.47th	v3 (v2023.03.01)
Apr 29, 2024	1.21% (0.01207)	85.04th	v3 (v2023.03.01)
Dec 1, 2023	1.16% (0.01163)	83.23th	v3 (v2023.03.01)
Oct 29, 2023	0.94% (0.00942)	81.38th	v3 (v2023.03.01)
Mar 7, 2023	0.84% (0.00837)	79.46th	v3 (v2023.03.01)
Mar 6, 2023	2.51% (0.02509)	81.86th	v2 (v2022.01.01)
Feb 4, 2022	2.51% (0.02509)	58.60th	v2 (v2022.01.01)
Feb 3, 2022	1.82% (0.01819)	35.19th	v5 (v2026.06.15)
Apr 14, 2021	1.82% (0.01819)	0.00th	v1

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (8)

https://access.redhat.com/security/cve/CVE-2018-5809
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1661520
Issue Tracking
https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt
x_refsource_MISCRelease Notes
https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9
x_refsource_MISCPatch
https://nvd.nist.gov/vuln/detail/CVE-2018-5809
https://secuniaresearch.flexerasoftware.com/advisories/81800/
third-party-advisoryx_refsource_SECUNIAThird Party Advisory
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-9/
x_refsource_MISCThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-5809

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-5809		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1661520		Issue Tracking
https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt		x_refsource_MISCRelease Notes
https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9		x_refsource_MISCPatch
https://nvd.nist.gov/vuln/detail/CVE-2018-5809
https://secuniaresearch.flexerasoftware.com/advisories/81800/		third-party-advisoryx_refsource_SECUNIAThird Party Advisory
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-9/		x_refsource_MISCThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-5809