{"id":"AZL-108254","summary":"CVE-2026-111272 affecting package LibRaw 0.21.3-1","details":"LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.","modified":"2026-10-17T05:32:47Z","published":"2026-10-15T22:19:28Z","upstream":["CVE-2026-111272"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111272"}],"affected":[{"package":{"name":"LibRaw","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/LibRaw"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.3-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108254.json"}}],"schema_version":"1.9.0"}