CVE-2026-64816 affects CyberTimon RapidRAW before version 1.6.0. The vulnerability arises because the lutPath field in preset files is not validated before being passed to File::open() in lut_processing.rs. On Windows, if lutPath contains a UNC path, the application initiates an SMB connection to the specified host, leaking NTLMv2 credentials. This code path is reachable via two vectors: community presets fetched automatically from the remote repository when the Community tab is opened, and individual preset files imported manually by users. The latter vector allows exploitation without control over the community preset repository, for example through preset files shared on Discord or forums.

An attacker can cause the victim's RapidRAW application to connect to an attacker-controlled SMB server by supplying a UNC path in the lutPath field of a preset file. This connection leaks the victim's NTLMv2 credentials, potentially enabling credential theft or relay attacks. The vulnerability requires user interaction (importing a preset or opening the Community tab) and affects Windows systems. There is no indication of privilege requirements or user interaction beyond opening/importing presets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening the Community tab or importing preset files from untrusted sources. Exercise caution when handling preset files received via external channels such as Discord or forums.