CVE-2018-19655

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-11-29 · updated 2026-06-17
Weakness: CWE-787

Description

A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file.

Affected products

Dcraw Project Dcraw: through 9.28
Suse Linux Enterprise Desktop: 12-sp3, 12-sp4
SUSE Linux Enterprise: 11-sp4, 12-sp3, 12-sp4

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890086
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906529
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3JX4A5F4DWP6NOEULXQXZ5AIH4GA62U/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RD65NMWZ5OQNUIF7CLGKLDG4LVPPMJY7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK4SHVVIZT6FHJVHOQSAFJMQWDLMWKDE/
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890086
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906529
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3JX4A5F4DWP6NOEULXQXZ5AIH4GA62U/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RD65NMWZ5OQNUIF7CLGKLDG4LVPPMJY7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK4SHVVIZT6FHJVHOQSAFJMQWDLMWKDE/

Get alerted when CVE-2018-19655 or the next vulnerability affects your stack