Medium
Security advisory
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-35534
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:41 UTC · Revision 1
Source evidence
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
osv:CVE-2020-35534
Complete source record
{
"id": "2b76372b2e6d1a64f44a82b2162cdd65631cb15d57983f79264f94da99f24415",
"url": "https://osv.dev/vulnerability/CVE-2020-35534",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-35534",
"summary": "In LibRaw, there is a memory corruption vulnerability within the \"crxFreeSubbandData()\" function (libraw\\src\\decoders\\crx.cpp) when processing cr3 files.",
"evidence": "osv:CVE-2020-35534",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-35534",
"aliases": [
"CVE-2020-35534"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libraw/libraw",
"type": "GIT",
"events": [
{
"introduced": "2aee1220d5ecdcb8887b11c3d505a900570852c6"
},
{
"last_affected": "0209b6a2caec189e6d1a9b21c10e9e49f46e5a92"
},
{
"fixed": "e41f331e90b383e3208cefb74e006df44bf3a4b8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libraw:libraw:0.20.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "0.20.0-NA"
},
{
"last_affected": "0.20.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:libraw:libraw:0.20.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.20.1"
},
{
"last_affected": "0.20.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:libraw:libraw:0.20.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.20.2"
},
{
"last_affected": "0.20.2"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "e41f331e90b383e3208cefb74e006df44bf3a4b8"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.20.0-NA",
"0.20.1",
"0.20.2",
"0.20.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35534.json",
"vanir_signatures": [
{
"id": "CVE-2020-35534-1183f3c9",
"digest": {
"length": 2598,
"function_hash": "304067255593464391204559877591262638598"
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "src/decoders/crx.cpp",
"function": "crxSetupImageData"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-35534-358dbf6f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"207025629213826478782711585089619196405",
"46210917819055421652970923090102933061",
"254433997921358066226404156423441657228",
"121994386768069482291492441094111723288",
"275102079883325482336975478637768809603",
"36697794633138683032327397447644895477",
"277118339117857684842982490009750716174",
"65645581251733642688664186356693583341",
"316087894895111894776509001086326422840",
"155094797138262158715011722943372759673",
"241262019974755519109528584818696405645",
"309469925143102725706567095418553205056",
"191222143218349248901340106387999577863",
"143694028460128255448081530377835469060",
"247622824270986836224606442603853476353",
"257006018023871358033745708324339880172",
"37068116164476279639823274019009488451",
"170953799371358395856627254918595508694",
"220827291551333629307864972198252591063",
"69979822832814378085247771266647826075",
"300944257647597002788893234091997179491",
"264667890937460988249141476038684755051",
"161730718990226723066611946387200200736",
"308098668655048793114324289161890508271",
"99535194873368442031758877532105173779",
"279971681981612285731267832377856569851",
"179823677049461061814453275736592047835",
"3722994086539316139008653408455388370",
"238339770923636238062750539650299150893",
"279574953964691476299066488056085901984",
"219297394625546144797780784734683941176",
"92297341031626493260490847218284817970",
"130003116614256576847249031700490520883",
"74071469155823240007765569727079761576",
"129568879526085123979665197806059272639",
"340058611344724610711778372090807272294",
"279624443580856459789975734621925894814",
"120319890168423194387580495270527790724",
"87497126820268909636269769173084844130",
"266241160173850832154973810057645275031",
"308721921421513706366758030383134252262",
"161770792435430140389162847295878330703",
"214945933418850996100457723086524168082"
]
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "src/decoders/crx.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-35534-459c908e",
"digest": {
"length": 477,
"function_hash": "86253214918197525464279454160269446819"
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "src/decoders/crx.cpp",
"function": "crxFreeImageData"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-35534-54444d4f",
"digest": {
"length": 3296,
"function_hash": "115870271723420634714950939325653787158"
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "src/decoders/crx.cpp",
"function": "crxReadImageHeaders"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-35534-ae664cc9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"257565646438463229760550925027380287191",
"129219754118494595211010221887387401221",
"106762490404665023299031489473230734750"
]
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "libraw/libraw_const.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-35534-d16f5509",
"digest": {
"length": 1053,
"function_hash": "324504935333696376085606239220186075503"
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "src/decoders/crx.cpp",
"function": "crxParamInit"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-35534-d1f4918e",
"digest": {
"length": 2804,
"function_hash": "230160589078258416786847250213180826865"
},
"source": "https://github.com/libraw/libraw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"target": {
"file": "src/decoders/crx.cpp",
"function": "crxSetupSubbandData"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:12:03Z"
}
}
],
"modified": "2026-10-20T14:12:03.764252454Z",
"provider": "osv",
"references": [
"https://github.com/LibRaw/LibRaw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8",
"https://github.com/LibRaw/LibRaw/issues/279"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:libraw:libraw:0.20.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:libraw:libraw:0.21.0:beta1:*:*:*:*:*:*"
],
"vendor_product": "libraw:libraw",
"extracted_events": [
{
"range": [
{
"introduced": "0.20.0-rc2"
},
{
"last_affected": "0.20.0-rc2"
},
{
"introduced": "0.21.0-beta1"
},
{
"last_affected": "0.21.0-beta1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-35534",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388707,
"published_at": "2022-09-01T18:15:08.97+00:00"
}