CVE-2017-6887: Libraw

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.

Affected products

• Libraw Libraw: up to and including 0.18.1

Published 2017-05-16. Last modified 2026-06-17.