• (as described on author's page): This CVE report is based "only on static analysis" without attempting to reproduce the issue at runtime.
• In fact, "static analysis" failed: it assumes system calloc() use for memory allocation while LibRaw::calloc() is used in reality.
• So, "discovered" OOB-heap accesses by fixed offset(s) are not OOB, all accesses occur within the allocated buffer
• The author made no attempts to contact our team.
• Our attempts to contact him also went unanswered.

Summary: this is false positive and a very bad example of reporting a non-existent vulnerability without trying to contact the vendor.

We are still waiting for the author to contact us