Security readout for executives and security teams
Plain-English summary
LibRaw can read beyond intended memory while processing a crafted image with an unusually large row_stride value. The likely business risk is disruption or data exposure inside applications that automatically parse user-supplied RAW images. Public sources do not provide CVSS scoring or evidence of active exploitation.
Executive priority
Handle as a dependency remediation item, with higher urgency for internet-facing image upload or conversion workflows. The absence of CVSS and KEV evidence lowers certainty, not necessarily impact.
Technical view
CVE-2020-35532 is a CWE-125 out-of-bounds read in LibRaw's simple_decode_row() within src/x3f/x3f_utils_patched.cpp. The trigger described is an image with a large row_stride field. Listed affected versions are LibRaw 0.21-Beta1 and 0.20.0 through 0.20.2, including 0.20-RC2.
Likely exposure
Exposure is most likely where affected LibRaw versions parse untrusted RAW or X3F image files, including upload services, media processing pipelines, desktop tools, or backend conversion jobs that embed LibRaw.
Exploitation context
The source bundle does not show CISA KEV listing, active exploitation, public weaponization, or CVSS severity. The available evidence supports malformed-file triggering, but not real-world attack activity.
Researcher notes
Focus validation on LibRaw dependency paths and RAW/X3F parsing surfaces. The public description identifies the vulnerable function and trigger condition, while the GitHub commit and Debian advisory provide remediation evidence without enough detail to infer broader exploitability.
Mitigation direction
- Inventory software and packages that include LibRaw.
- Upgrade LibRaw or distribution packages using vendor security guidance.
- Prioritize systems that process user-supplied RAW images.
- Limit automated parsing of untrusted RAW files until updated.
- Check Debian LTS guidance where Debian packages are used.
Validation and detection
- Confirm deployed LibRaw versions are not listed as affected.
- Review package changelogs for CVE-2020-35532 or the referenced fix.
- Verify exposed upload and conversion services use patched dependencies.
- Check security scanning results for bundled LibRaw copies.
- Document any exception where vendor guidance is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-35532 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/LibRaw/LibRaw/issues/271CVE reference · x_refsource_MISC
- https://github.com/LibRaw/LibRaw/commit/5ab45b085898e379fedc6b113e2e82a890602b1eCVE reference · x_refsource_MISC
- [debian-lts-announce] 20220916 [SECURITY] [DLA 3113-1] libraw security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.