CVE-2026-88387

What it actually does

LibRaw 0.22.0's TIFF IFD parser (LibRaw::parse_tiff_ifd) converts TIFF tag 0x00fe (NewSubfileType) to a signed int without range validation. An attacker-controlled value outside the signed int range causes an out-of-range narrowing conversion, which is undefined behavior and typically aborts the parsing process. The result is a local denial of service of the host application; confidentiality and integrity are not affected, and no memory-corruption or code-execution impact is indicated.

Why it matters to the business

Any product that uses LibRaw 0.22.0 to ingest RAW, TIFF, or DNG files can be crashed by a single malicious image, interrupting photo workflows, digital asset management, thumbnailing, forensic review, and unattended batch ingest. Jobs that retry the same file may fail in a loop until the file is removed. The issue is not in CISA KEV, is not associated with ransomware, and has no known in-the-wild exploit about 16 days after publication, so urgency is moderate—but always-on ingest pipelines remain an availability risk until the library is upgraded.

How an attack unfolds

An attacker prepares a RAW, TIFF, or DNG file whose NewSubfileType tag holds a value that cannot be represented as a signed int, then delivers it through a channel that causes a user or automated service to open it with a LibRaw-linked application (attachment, download, shared folder, upload portal, or camera-card ingest). When parse_tiff_ifd processes the tag, the unvalidated conversion triggers undefined behavior and the process terminates. Exploitation is local, requires the victim or pipeline to parse the file, and does not provide a remote unauthenticated network vector. No named threat actors or campaigns are associated with this CVE, and exploit maturity is none.

How to fix it

Upgrade LibRaw off 0.22.0 to a vendor release that validates NewSubfileType before converting it to a signed int. No specific fixed version was listed in the advisory data—track official LibRaw release notes and package updates, then rebuild or redeploy every application, container, and statically linked binary that embeds the library. Until a patch is available, do not parse untrusted RAW/TIFF/DNG files in privileged or always-on services, sandbox image-ingest workers, disable automatic thumbnailing of untrusted files, and restrict ingest to trusted sources.

How to confirm the fix worked

Inventory hosts, containers, and applications for LibRaw 0.22.0 via package metadata, bundled copies, and linked shared libraries. After upgrading, confirm the runtime library is newer than 0.22.0 and that image-ingest services remain stable on legitimate RAW, TIFF, and DNG samples. Watch crash and restart rates for ingest and thumbnail workers post-rollout; a return to baseline abort rates indicates the availability issue is addressed.

Typical attack path

1. Create a RAW, TIFF, or DNG file with an out-of-range NewSubfileType (TIFF tag 0x00fe) value
2. Deliver the file via email, download, shared storage, upload, or media ingest
3. Wait for a user or automated processor using LibRaw 0.22.0 to open, thumbnail, or otherwise parse the file
4. LibRaw::parse_tiff_ifd converts the tag without range checks and the consuming process aborts
5. Leave the file in a watched ingest location or resend it to prolong downtime of batch pipelines

How to detect it

There is no public evidence of in-the-wild exploitation. Hunt crash dumps, core files, systemd/journald or equivalent supervisor logs, and application error logs for processes that link LibRaw and aborted while opening RAW, TIFF, or DNG files on or after the publication date. Prioritize stack traces naming LibRaw::parse_tiff_ifd and fatal signals (SIGABRT, SIGSEGV, SIGFPE) in libraw. Correlate crashes with arrival of unusual image files on mail gateways, file shares, or upload portals immediately beforehand. Repeated ingest-job failures against the same image are a strong availability indicator; lack of crashes does not prove the library was unexposed.

• LibRaw::parse_tiff_ifd
• parse_tiff_ifd
• libraw
• NewSubfileType
• tag 0x00fe

What your security team should do

• Inventory all packages, containers, and binaries that ship or link LibRaw 0.22.0, including statically linked copies
• Upgrade to a patched LibRaw release as soon as the vendor publishes one and rebuild static binaries
• Until patched, sandbox untrusted image ingest and disable automatic processing of RAW/TIFF/DNG from untrusted sources
• Monitor crash and restart rates on image-processing services and investigate abort storms tied to those file types
• Treat this as a scheduled availability fix rather than an emergency incident (not KEV, no known exploit), but prioritize always-on ingest pipelines