High
Security advisory
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15503
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
osv:CVE-2020-15503
Complete source record
{
"id": "69325ed63dc4f3a0c9eee889854fb57c232c15dd35b1c1ede8ee4a790b3e81a9",
"url": "https://osv.dev/vulnerability/CVE-2020-15503",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15503",
"summary": "LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.",
"evidence": "osv:CVE-2020-15503",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-15503",
"aliases": [
"CVE-2020-15503"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libraw/libraw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "beeb572687270d49c16734c9ca620982151dbeff"
},
{
"fixed": "20ad21c0d87ca80217aee47533d91e633ce1864d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libraw:libraw:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.19.5"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "20ad21c0d87ca80217aee47533d91e633ce1864d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.19.5",
"0.19.4",
"0.19.3",
"0.19.2",
"0.19.1",
"0.19.0",
"0.18.0",
"0.17.0",
"0.16.0",
"0.15.0",
"0.14.6",
"0.14.5",
"0.14.4",
"0.14.3",
"0.14.2",
"0.14.1",
"0.14.0",
"0.13.6",
"0.13.5",
"0.13.4",
"0.13.3",
"0.13.2",
"0.13.1",
"0.13.0",
"0.12.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15503.json",
"vanir_signatures": [
{
"id": "CVE-2020-15503-4de4e8ed",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95504925387959412511911477587878745185",
"211498614830520016092898085902592191304",
"258909625175771742828218197375693978553"
]
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "src/utils/thumb_utils.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15503-b47b1d85",
"digest": {
"length": 5265,
"function_hash": "20834980326322708084884246758929434607"
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "src/utils/thumb_utils.cpp",
"function": "LibRaw::kodak_thumb_loader"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15503-bab2ecca",
"digest": {
"length": 1869,
"function_hash": "60925816791984355313585374140980915893"
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "src/postprocessing/mem_image.cpp",
"function": "LibRaw::dcraw_make_mem_thumb"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15503-bd149f8b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"59779410903218153793678754994680767601",
"132752582361061888394256996303006118673",
"185045691167740575729910415964833655416",
"161049959832819816644170497010757592682",
"260007268614515162766175710996963767171",
"255532408959626893688328621463383668856",
"293793618887016688055475224622010045250",
"237163547497289955783163831819047220253",
"53946906021982039869438027886283012302",
"159623424722262447118890624610300865183",
"24074827839660080180766803516914248259",
"193770801203564601580014460272938621217",
"279776459699944493687719371011149108112",
"106535962320044590641199677616499872207",
"283450966731452391535050062147183429866",
"94649701061232974678424622551508588263",
"211509070784551980709998278180183119961",
"283511725562753475212592465244817300621",
"80668828536364397405743644776123983152",
"237567926824714123645467842340474684318",
"285312419739008761685997607143246357862",
"258224793432605195806530931128263774249",
"65443162971290850839897068754309996559",
"148315636905740143535486119577249766951",
"181202847632146431652953263163741802944",
"106211129585307599656075310087927609507",
"195072596634072040877784318058145114722",
"306099842656121619297437396043320744575",
"239128415640668498542060449212822440966",
"25636571237006944437910063657224247718",
"78239118379284603983132881493921935450",
"47533961952800260579564617492129636545"
]
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "src/decoders/unpack_thumb.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15503-ccd49802",
"digest": {
"length": 7684,
"function_hash": "51726212998995411333273680451998935224"
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "src/decoders/unpack_thumb.cpp",
"function": "LibRaw::unpack_thumb"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15503-ddbaed06",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187981261985522913612295356341902997356",
"316324685096684762484593438217362973867",
"42418153475302119724450462163414037082"
]
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "src/postprocessing/mem_image.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15503-ddf53db8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249569001442104715920048703562899778"
]
},
"source": "https://github.com/libraw/libraw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d",
"target": {
"file": "libraw/libraw_const.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:52:29Z"
}
}
],
"modified": "2026-10-20T13:52:29.107697564Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HM2DS6HA4YZREI3BYGS75M6D76WMW62/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSXAJKZ4VNDYVQULJNY4XDPWHIJDTB4P/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNGDWTO45TU4KGND75EUUEGUMNSOYC7H/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCVKD7PTO7UQAVUTBHJAKBKYLPQQGAMZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y34ALB34P3NGQXLF7BG7R6DGRX6XL2JN/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZETDVPZQWZWVGIG6JTIEKP5KPVMUE7Y/",
"https://github.com/LibRaw/LibRaw/compare/0.20-Beta3...0.20-RC1",
"https://lists.debian.org/debian-lts-announce/2022/11/msg00042.html",
"https://www.libraw.org/news/libraw-0-20-rc1",
"https://github.com/LibRaw/LibRaw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "31"
},
{
"last_affected": "31"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:libraw:libraw:0.20:beta1:*:*:*:*:*:*",
"cpe:2.3:a:libraw:libraw:0.20:beta2:*:*:*:*:*:*",
"cpe:2.3:a:libraw:libraw:0.20:beta3:*:*:*:*:*:*"
],
"vendor_product": "libraw:libraw",
"extracted_events": [
{
"range": [
{
"introduced": "0.20-beta1"
},
{
"last_affected": "0.20-beta1"
},
{
"introduced": "0.20-beta2"
},
{
"last_affected": "0.20-beta2"
},
{
"introduced": "0.20-beta3"
},
{
"last_affected": "0.20-beta3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-15503",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388321,
"published_at": "2020-07-02T14:15:11.683+00:00"
}