A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
CVSS Details
- CVSS 4.0 Base Score: 4.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade compat-libtiff3-debuginfoUpgrade libtiffUpgrade compat-libtiff3Upgrade libtiff-staticUpgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiff-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiff-tools-debuginfoUpgrade libtiff-toolsUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff | Sep 9, 2025 | Aug 11, 2025 |
| Debian | — | Upgrade tiff | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libtiff | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libtiff | Dec 12, 2025 | Nov 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libtiff | Nov 12, 2025 | Nov 11, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libtiff | Nov 21, 2025 | Nov 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 11, 2025 |
| Suse | — | Upgrade libtiff5Upgrade tiffUpgrade libtiff-devel-32bitUpgrade libtiff6-32bitUpgrade libtiff6Upgrade libtiff-develUpgrade libtiff5-32bit | Dec 5, 2025 | Nov 5, 2025 |
| Ubuntu | — | Upgrade libtiff5 (Ubuntu Pro)Upgrade libtiff-tools (Ubuntu Pro)Upgrade libtiff5Upgrade libtiff-toolsUpgrade libtiff6 | Aug 22, 2025 | Aug 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Aug 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub