CVE-2015-3885: Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a d...

Security readout for executives and security teams

CVE-2015-3885 is a crash risk in older dcraw RAW image parsing. A specially crafted image can trigger an integer overflow and resulting buffer overflow, causing denial of service. Sources do not establish active exploitation or code execution. Exposure is most likely in systems, services, or desktop workflows that process untrusted RAW images using dcraw 7.00 or earlier, or packaged downstream code covered by the cited Fedora, Gentoo, LibRaw, and rawstudio references. Treat this as a focused remediation item for image-processing environments, especially public upload or automated media pipelines. It is not KEV-listed in the supplied data, but untrusted file parsing can disrupt services. Mitigation focus: Inventory dcraw and downstream RAW image parsing packages in image-processing paths.; Apply relevant vendor or distribution updates from Fedora, Gentoo, Oracle, LibRaw, or rawstudio guidance.; Restrict processing of untrusted RAW images until affected components are updated..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.