A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
CVSS Details
- CVSS 4.0 Base Score: 4.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade compat-libtiff3Upgrade compat-libtiff3-debuginfoUpgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff-static | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-debuginfoUpgrade libtiff-develUpgrade libtiff-debugsourceUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfo | Sep 9, 2025 | Aug 11, 2025 |
| Debian | — | Upgrade tiff | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libtiff | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libtiff | Dec 12, 2025 | Nov 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libtiff | Nov 12, 2025 | Nov 11, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libtiff | Nov 21, 2025 | Nov 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 11, 2025 |
| Suse | — | Upgrade libtiff6-32bitUpgrade libtiff5Upgrade tiffUpgrade libtiff6Upgrade libtiff-devel-32bitUpgrade libtiff5-32bitUpgrade libtiff-devel | Dec 5, 2025 | Nov 5, 2025 |
| Ubuntu | — | Upgrade libtiff-toolsUpgrade libtiff5Upgrade libtiff6Upgrade libtiff-tools (Ubuntu Pro)Upgrade libtiff5 (Ubuntu Pro) | Aug 22, 2025 | Aug 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Aug 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub