Is CVE-2026-111272 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111272?

CVE-2026-111272 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-111272

Description

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.