CVE-2013-1438: Dave Coffin Dcraw

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.

Affected products

• Dave Coffin Dcraw: version 0.8.0 only; version 0.8.1 only; version 0.8.2 only; version 0.8.3 only; version 0.8.4 only; version 0.8.5 only; …

Published 2014-01-19. Last modified 2026-06-16.