Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Conclusion & alert: CVE-2015-3885 is rated Moderate Risk (46.9/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 4.73%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-07 | 6.39% | 4.73% | -1.66% |
| 2 | 2026-06-06 | 3.56% | 6.39% | +2.83% |
| 3 | 2025-10-17 | — | 3.56% | — |
Full EPSS history (13 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2015-3885 not yet assigned priority: Debian including 7 source packages (darktable, dcraw, …), 35 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 35. | https://security-tracker.debian.org/tracker/CVE-2015-3885 |
gentoo
|
normal | CVE-2015-3885: 3 GLSA(s) (201701-54, 201701-60, 201706-17), 3 atom(s) (media-gfx/dcraw, media-libs/libraw, media-tv/kodi); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2015-3885 |
redhat
|
low | — | https://access.redhat.com/security/cve/CVE-2015-3885 |
suse
|
low | CVE-2015-3885 severity low: SUSE including 23 source package names (darktable-2.0.7-1.1, darktable-doc-2.0.7-1.1, …), 99 product×package rows across 45 product lines (SUSE CaaS Platform 4.5, SUSE Enterprise Storage 7, … (45 product lines)): Known Not Affected 75, Fixed 24. | https://www.suse.com/security/cve/CVE-2015-3885/ |
ubuntu
|
negligible | CVE-2015-3885 negligible priority: Ubuntu including 10 source packages (darktable, dcraw, …), 260 status rows across 26 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, precise, questing, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 130, DNE 67, ignored 48, released 10, needed 4, needs-triage 1. | https://ubuntu.com/security/CVE-2015-3885 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| dcraw_project | dcraw | <= 7.00 | cpe:2.3:a:dcraw_project:dcraw:*:*:*:*:*:*:*:* |
| fedoraproject | fedora | 21 | cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* |