Input Validation and Logic

Every one of the 3 is a mark on the map. Named now: 1 to 3, most at risk first.

1. LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(siz…CVE-2020-15503Libraw · 3.3% likely

   CWE-20

2. There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack.CVE-2017-13735Libraw · 3.0% likely

   CWE-20

3. In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.CVE-2025-43964LibRaw · CVSS 2.9 · 0.4% likely

   CWE-1284

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.