CVE-2026-64816 CyberTimon CVE debrief

Who should care

Users of RapidRAW versions before 1.6.0, especially those who import preset files from untrusted sources or use community presets, should be aware of this vulnerability and take steps to mitigate it. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their environments and take appropriate actions.

Technical summary

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature.

Defensive priority

RapidRAW users should prioritize patching to prevent potential credential leaks.

Recommended defensive actions

• Apply the patch to update RapidRAW to version 1.6.0 or later
• Review and restrict preset files imported from untrusted sources
• Monitor for suspicious SMB connections
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates that RapidRAW before 1.6.0 does not validate the lutPath field in preset files, potentially leading to an outbound SMB connection to an attacker-controlled host and leaking the victim's NTLMv2 credentials. The vulnerable code path can be reached through community presets or individual preset files imported directly by the victim.

Official resources