High severity7.8NVD Advisory· Published Apr 18, 2022· Updated Jun 17, 2026

CVE-2021-3624

Description

There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system.

Affected products

dcraw/dcrawdescription
osv-coords4 versions
pkg:rpm/opensuse/dcraw&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/dcraw&distro=openSUSE%20Tumbleweed pkg:rpm/suse/dcraw&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/dcraw&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP5
< 9.28.0-150000.3.3.1+ 3 more
- (no CPE)range: < 9.28.0-150000.3.3.1
- (no CPE)range: < 9.28.0-2.1
- (no CPE)range: < 9.28.0-3.3.1
- (no CPE)range: < 9.28.0-3.3.1
Dcraw Project/Dcrawllm-create2 versions
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:dcraw_project:dcraw:9.28-2:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

bugs.debian.org/cgi-bin/bugreport.cginvdExploitIssue TrackingThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000