CVE-2026-24808CWE-190

A possible integer overflow vulnerability in RawTherapee/RawTherapee

High · published January 27, 2026

CVSS v4.0
8.3
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

Integer Overflow or Wraparound vulnerability in RawTherapee (rtengine modules). This vulnerability is associated with program files dcraw.Cc.

This issue affects RawTherapee: through 5.11.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:P/AU:Y/R:U/V:C/RE:M/U:Amber
EPSS
0.00137 · 2.8th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-01-27T08:44Z
EPSS history
Timeline
  • 27 JAN 08:44Z
    A possible integer overflow vulnerability in RawTherapee/RawTherapee
    cvelistv5