In LibRaw, there is an out-of-bounds write vulnerability within the "new node()" function (librawsrcx3fx3f utils patched.cpp) that can be triggered via a crafted X3F file.