CVE-2026-24808
CVE-2026-24808 · A possible integer overflow vulnerability in RawTherapee/RawTherapee
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Integer Overflow or Wraparound vulnerability in RawTherapee (rtengine modules). This vulnerability is associated with program files dcraw.Cc. This issue affects RawTherapee: through 5.11.
CVSS 8.3 · High · EPSS 0.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
rawtherapee
- Versions
- ≥ 0, ≤ 5.11: Affected (git)
No fix published
rawtherapee Debian:12
- Versions
- 5.10-1
- 5.11-1
- 5.11-2
- 5.12-1
- 5.12-2
- 5.9-1
- 5.9-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Debian:13
- Versions
- 5.11-2
- 5.12-1
- 5.12-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Debian:14
- Versions
- 5.11-2
- Affected ranges
- ECOSYSTEM: < 5.12-1
Update to 5.12-1
rawtherapee Ubuntu:16.04:LTS
- Versions
- 4.2-2build1
- 4.2-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:18.04:LTS
- Versions
- 5.2-1
- 5.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:20.04:LTS
- Versions
- 5.6-1
- 5.7-1
- 5.8-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:22.04:LTS
- Versions
- 5.8-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:24.04:LTS
- Versions
- 5.9-1build1
- 5.9-2
- 5.10-1
- 5.10-1build3
- 5.10-1build4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rawtherapee Ubuntu:25.10
- Versions
- 5.11-2build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published