{"id":"CVE-2020-35534","details":"In LibRaw, there is a memory corruption vulnerability within the \"crxFreeSubbandData()\" function (libraw\\src\\decoders\\crx.cpp) when processing cr3 files.","modified":"2026-07-08T20:42:38.772869Z","published":"2022-09-01T18:15:08.970Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:libraw:libraw:0.20.0:rc2:*:*:*:*:*:*","cpe:2.3:a:libraw:libraw:0.21.0:beta1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.20.0-rc2"},{"last_affected":"0.20.0-rc2"},{"introduced":"0.21.0-beta1"},{"last_affected":"0.21.0-beta1"}],"source":"CPE_STRING","vendor_product":"libraw:libraw"}]},"references":[{"type":"FIX","url":"https://github.com/LibRaw/LibRaw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8"},{"type":"FIX","url":"https://github.com/LibRaw/LibRaw/issues/279"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libraw/libraw","events":[{"introduced":"2aee1220d5ecdcb8887b11c3d505a900570852c6"},{"last_affected":"0209b6a2caec189e6d1a9b21c10e9e49f46e5a92"},{"fixed":"e41f331e90b383e3208cefb74e006df44bf3a4b8"}],"database_specific":{"cpe":["cpe:2.3:a:libraw:libraw:0.20.0:-:*:*:*:*:*:*","cpe:2.3:a:libraw:libraw:0.20.1:*:*:*:*:*:*:*","cpe:2.3:a:libraw:libraw:0.20.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.20.0-NA"},{"last_affected":"0.20.0-NA"},{"introduced":"0.20.1"},{"last_affected":"0.20.1"},{"introduced":"0.20.2"},{"last_affected":"0.20.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.20.0-NA","0.20.1","0.20.2","0.20.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35534.json","vanir_signatures_modified":"2026-07-08T20:42:38Z","vanir_signatures":[{"id":"CVE-2020-35534-1183f3c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"function":"crxSetupImageData","file":"src/decoders/crx.cpp"},"deprecated":false,"digest":{"function_hash":"304067255593464391204559877591262638598","length":2598}},{"digest":{"line_hashes":["207025629213826478782711585089619196405","46210917819055421652970923090102933061","254433997921358066226404156423441657228","121994386768069482291492441094111723288","275102079883325482336975478637768809603","36697794633138683032327397447644895477","277118339117857684842982490009750716174","65645581251733642688664186356693583341","316087894895111894776509001086326422840","155094797138262158715011722943372759673","241262019974755519109528584818696405645","309469925143102725706567095418553205056","191222143218349248901340106387999577863","143694028460128255448081530377835469060","247622824270986836224606442603853476353","257006018023871358033745708324339880172","37068116164476279639823274019009488451","170953799371358395856627254918595508694","220827291551333629307864972198252591063","69979822832814378085247771266647826075","300944257647597002788893234091997179491","264667890937460988249141476038684755051","161730718990226723066611946387200200736","308098668655048793114324289161890508271","99535194873368442031758877532105173779","279971681981612285731267832377856569851","179823677049461061814453275736592047835","3722994086539316139008653408455388370","238339770923636238062750539650299150893","279574953964691476299066488056085901984","219297394625546144797780784734683941176","92297341031626493260490847218284817970","130003116614256576847249031700490520883","74071469155823240007765569727079761576","129568879526085123979665197806059272639","340058611344724610711778372090807272294","279624443580856459789975734621925894814","120319890168423194387580495270527790724","87497126820268909636269769173084844130","266241160173850832154973810057645275031","308721921421513706366758030383134252262","161770792435430140389162847295878330703","214945933418850996100457723086524168082"],"threshold":0.9},"id":"CVE-2020-35534-358dbf6f","signature_type":"Line","signature_version":"v1","source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"file":"src/decoders/crx.cpp"},"deprecated":false},{"digest":{"function_hash":"86253214918197525464279454160269446819","length":477},"id":"CVE-2020-35534-459c908e","signature_type":"Function","signature_version":"v1","source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"file":"src/decoders/crx.cpp","function":"crxFreeImageData"},"deprecated":false},{"source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"file":"src/decoders/crx.cpp","function":"crxReadImageHeaders"},"deprecated":false,"digest":{"function_hash":"115870271723420634714950939325653787158","length":3296},"id":"CVE-2020-35534-54444d4f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"file":"libraw/libraw_const.h"},"deprecated":false,"digest":{"line_hashes":["257565646438463229760550925027380287191","129219754118494595211010221887387401221","106762490404665023299031489473230734750"],"threshold":0.9},"id":"CVE-2020-35534-ae664cc9","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"file":"src/decoders/crx.cpp","function":"crxParamInit"},"deprecated":false,"digest":{"function_hash":"324504935333696376085606239220186075503","length":1053},"id":"CVE-2020-35534-d16f5509"},{"source":"https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8","target":{"function":"crxSetupSubbandData","file":"src/decoders/crx.cpp"},"deprecated":false,"digest":{"function_hash":"230160589078258416786847250213180826865","length":2804},"id":"CVE-2020-35534-d1f4918e","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}