LibRaw 0.22.2 adds bounds, overflow and recursion checks across RAW decoders

LibRaw 0.22.2 was released on July 16 as a bugfix-only update. The project lists checks for FP DNG tile indexes and bit depth, CR3 plane sizes and allocation arithmetic, PPM16 thumbnail limits, Phase One flat-field buffers, Fuji image dimensions, X3F structures and very deep MOS or QuickTime nesting.

The notes also mention zeroing read buffers, guarding row stride against buffer size, preventing several possible integer or allocation overflows and fixing possible stack-memory or previous-image metadata exposure reported by MemorySanitizer. The release page does not present a consolidated CVE list or claim that every item is remotely exploitable.

A RAW file is active input to a complex decoder, not an inert photograph. Studios that receive files from clients, public submissions or recovered media should treat decoder versions as part of the security and reliability baseline. The practical win arrives downstream only when the actual converter, DAM or editor bundles 0.22.2.

We are watching application-vendor adoption, distro packages and any later advisories mapping individual fixes to CVEs. Before rollout, test a representative RAW corpus, thumbnails, sidecars and round trips; do not assume an application’s visible version reveals its bundled LibRaw build.