CVE-2026-24808: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-24808 is an Integer Overflow or Wraparound vulnerability (CWE-190) in RawTherapee's rtengine module, specifically within the dcraw.cc source file in the parse_qt() function. It affects RawTherapee through version 5.11 and was publicly disclosed on January 27, 2026. The vulnerability was introduced because RawTherapee cloned code from LibRaw but did not incorporate a security patch that LibRaw had previously applied for a related issue (CVE-2018-5815). It carries a CVSS v4.0 base score of 8.3 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an integer overflow or wraparound (CWE-190) in the parse_qt() function within rtengine/dcraw.cc. This code was originally cloned from LibRaw but did not receive the security fix that LibRaw applied in commit 1334647 for CVE-2018-5815. An attacker can trigger the overflow by supplying a specially crafted image file that causes arithmetic on integer values to wrap around, potentially leading to out-of-bounds memory access. Exploitation requires local access and active user interaction — specifically, a user must open a malicious image file in RawTherapee. The fix was merged into the RawTherapee dev branch on April 22, 2025, via pull request #7359 (GitHub PR #7359, Red Hat Bugzilla).

Successful exploitation can result in data corruption or denial of service conditions due to the integer overflow leading to improper memory operations. The CVSS v4.0 assessment indicates a HIGH integrity impact and HIGH availability impact, with LOW confidentiality impact. Because exploitation requires a user to open a crafted file locally, the blast radius is limited to the affected workstation and the user's session, with no direct path to remote code execution or lateral movement documented at this time (Red Hat Advisory, GitHub PR #7359).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

1. Craft a malicious image file: Create a specially crafted image file (e.g., a RAW format file) that contains malformed QuickTime-style metadata or atom structures designed to trigger integer overflow in the parse_qt() function within dcraw.cc.
2. Deliver the file to the target: Use social engineering, a malicious download link, or a shared file system to deliver the crafted image to a user running a vulnerable version of RawTherapee (≤ 5.11).
3. Induce the user to open the file: The vulnerability requires active user interaction — the target must open the crafted file in RawTherapee.
4. Trigger the overflow: When RawTherapee processes the file, the parse_qt() function performs arithmetic on attacker-controlled integer values without adequate bounds checking, causing an integer wraparound.
5. Achieve impact: The overflow leads to improper memory access, potentially causing application crash (denial of service) or data corruption within the process context (GitHub PR #7359).

• File System: Presence of unexpected or unusually structured RAW image files (e.g., .cr2, .nef, .arw, .dng) received from untrusted sources in directories accessible to RawTherapee.
• Process: RawTherapee process (rawtherapee or rawtherapee-cli) crashing unexpectedly or producing segmentation fault signals when opening specific image files.
• Logs: Application crash logs or core dumps associated with the rawtherapee process, particularly referencing dcraw.cc or parse_qt in stack traces.
• Network: Unusual inbound file transfers (e.g., via email, web download) of RAW image files from unknown or untrusted external sources preceding application crashes.

Users should upgrade RawTherapee to a version after 5.11, which incorporates the fix merged on April 22, 2025 (PR #7359 targeting the dev branch, expected in the 5.12 release). Until patching is complete, users should avoid opening RAW image files from untrusted or unknown sources in RawTherapee. On shared or multi-user systems, consider restricting access to RawTherapee or implementing file-type filtering to block untrusted image files. A patch reference is tracked in Red Hat Bugzilla under ID 2433200 (GitHub PR #7359, Red Hat Bugzilla).

Coverage of CVE-2026-24808 has been limited to automated vulnerability tracking platforms such as Vulners, CVEfeed.io, and VulDB, with no notable researcher commentary or vendor statements beyond the Red Hat Bugzilla entry and the GitHub pull request discussion. The fix was quietly merged by RawTherapee collaborator Lawrence37 after a contributor (npt-1707) identified the missing LibRaw security patch and submitted PR #7359. No significant media coverage or social media discussion has been observed (GitHub PR #7359).