CVE-2020-15503
moderate-risk
Published 2020-07-02
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
Do I need to act?
~
3.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Vendors
References (24)
Broken Link
https://www.libraw.org/news/libraw-0-20-rc1
and 4 more references
47
/ 100
moderate-risk
Severity
26/34 · High
Exploitability
7/34 · Low
Exposure
14/34 · Moderate