CVE-2026-88387

Name of the Vulnerable Software and Affected Versions LibRaw version 0.22.0

Description An incorrect numeric conversion occurs in the parse tiff ifd() function when processing the TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can provide a NewSubfileType value that exceeds the range of a signed integer. The parser narrows this value to an integer without range validation, causing undefined behavior that leads to process termination and denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.