CVE-2021-3624: Dcraw Project Dcraw

High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days.

There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system.

Affected products

• Dcraw Project Dcraw: version 9.28-2 only
• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only

Published 2022-04-18. Last modified 2026-06-17.