CVE-2023-52355: libtiff Out-of-bounds Write

Vulnerability summary

CVE-2023-52355 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in libtiff. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-01-2024
   PublishedVulnerability first disclosed.
2. 02-10-2026
   Last modifiedVulnerability information updated.

Description

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.