CVE-2018-5817 — LibRaw: DoS in unpacked_load_raw function in internal/dcraw_common.cpp

Back Back to CVE browser

HIGH

LibRaw: DoS in unpacked_load_raw function in internal/dcraw_common.cpp

Published Feb 20, 2019

7.5

HIGH

CVSS 3.0

EPSS 2.50%

Description

A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop.

Affected products

Vendor Flexera Software LLC Product LibRaw Default
n/a
- Version
  0.19.0 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Flexera Software LLC

LibRaw

n/a

Version	Status	Constraints
0.19.0 and prior	affected	-

Red Hat Enterprise Linux 7

LibRaw

Not affected
Red Hat Enterprise Linux 8

LibRaw

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	LibRaw	Not affected	n/a
Red Hat Enterprise Linux 8	LibRaw	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of LibRaw as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.

Metrics

2.50% 0.02505

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02505

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.50% (0.02505)	84.16th	v5 (v2026.06.15)
Jun 15, 2026	2.50% (0.02505)	82.61th	v5 (v2026.06.15)
Dec 4, 2025	1.24% (0.01236)	78.61th	v4 (v2025.03.14)
Mar 29, 2025	2.35% (0.02351)	74.85th	v4 (v2025.03.14)
Jul 20, 2024	0.40% (0.00397)	73.73th	v3 (v2023.03.01)
Jul 8, 2024	0.40% (0.00397)	73.65th	v3 (v2023.03.01)
Feb 8, 2024	0.43% (0.00431)	73.79th	v3 (v2023.03.01)
Mar 7, 2023	0.35% (0.00349)	67.26th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Sep 10, 2022	1.02% (0.01018)	38.88th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)
Feb 3, 2022	1.04% (0.01040)	28.32th	v1
Jan 6, 2022	1.04% (0.01040)	27.69th	v1
Sep 1, 2021	1.04% (0.01040)	64.49th	v1
Apr 14, 2021	1.04% (0.01040)	0.00th	v1

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-704

References (8)

https://access.redhat.com/security/cve/CVE-2018-5817
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1661612
Issue Tracking
https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-5817
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27/
x_refsource_MISCThird Party Advisory
https://usn.ubuntu.com/3989-1/
vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2018-5817
https://www.libraw.org/news/libraw-0-19-2-release
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-5817		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1661612		Issue Tracking
https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-5817
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27/		x_refsource_MISCThird Party Advisory
https://usn.ubuntu.com/3989-1/		vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2018-5817
https://www.libraw.org/news/libraw-0-19-2-release		x_refsource_MISCRelease NotesVendor Advisory