libtiff
35 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-9900 | < 4.7.1 | Libtiff: libtiff write-what-where | HIGH 8.8 | 1.0 % | ||
| CVE-2025-9165 | 4.7.0 | LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak | LOW 2.0 | 0.2 % | ||
| CVE-2025-8961 | 4.7.0 | LibTIFF tiffcrop tiffcrop.c main memory corruption | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-8851 | 4.5.0 ; 4.5.1 | LibTIFF tiffcrop tiffcrop.c readSeparateStripsetoBuffer stack-based overflow | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-8534 | 4.6.0 | libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference | LOW 2.0 | 0.2 % | ||
| CVE-2024-13978 | 4.0 ; 4.1 ; 4.2 ; … | LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference | LOW 2.0 | 0.2 % | ||
| CVE-2025-8177 | 4.0 ; 4.1 ; 4.2 ; … | LibTIFF thumbnail.c setrow buffer overflow | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-8176 | 4.0 ; 4.1 ; 4.2 ; … | LibTIFF tiffmedian.c get_histogram use after free | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-7006 | fixed in 4.4.0, 4.0.9 | Libtiff: null pointer dereference in tif_dirinfo.c | HIGH 7.5 | 1.5 % | ||
| CVE-2023-52356 | < 4.6.0 | Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service | HIGH 7.5 | 2.2 % | ||
| CVE-2023-52355 | < 4.6.0 | Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom | HIGH 7.5 | 1.8 % | ||
| CVE-2023-3164 | | Heap-buffer-overflow in extractimagesection() | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-41175 | < 4.6.0 | Libtiff: potential integer overflow in raw2tiff.c | MEDIUM 6.5 | 1.3 % | ||
| CVE-2023-40745 | < 4.6.0 | Libtiff: integer overflow in tiffcp.c | MEDIUM 6.5 | 1.4 % | ||
| CVE-2023-3618 | | Segmentation fault in fax3encode in libtiff/tif_fax3.c | MEDIUM 6.5 | 1.2 % | ||
| CVE-2023-2908 | fixed in 4.5.1rc1 | Libtiff: null pointer dereference in tif_dir.c | MEDIUM 5.5 | 0.4 % | ||
| CVE-2023-30775 | 4.0 | A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-30774 | 4.0 | A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBERO | MEDIUM 5.5 | 0.5 % | ||
| CVE-2023-2731 | Fixed in libtiff v4.5.0 | A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker | MEDIUM 5.5 | 0.4 % | ||
| CVE-2023-1916 | libtiff versions 4.x and newer are affected | A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-3970 | n/a | LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow | HIGH 8.8 | 1.3 % | ||
| CVE-2022-2521 | libtiff 4.4.0rc1 | It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 | MEDIUM 6.5 | 1.3 % | ||
| CVE-2022-2520 | libtiff 4.4.0rc1 | A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash w | MEDIUM 6.5 | 1.3 % | ||
| CVE-2022-2519 | libtiff 4.4.0rc1 | There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 | MEDIUM 6.5 | 1.3 % | ||
| CVE-2022-1355 | Not-Known | A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-1354 | Not-Known | A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a c | MEDIUM 5.5 | 0.6 % | ||
| CVE-2022-2869 | libtiff 4.4.0rc1 | libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An at | MEDIUM 5.5 | 0.3 % | ||
| CVE-2022-2868 | libtiff 4.4.0rc1 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attac | MEDIUM 5.5 | 0.3 % | ||
| CVE-2022-2867 | libtiff 4.4.0rc1 | libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file t | MEDIUM 5.5 | 0.3 % | ||
| CVE-2022-1210 | 4.3.0 | LibTIFF tiff2ps resource consumption | MEDIUM 6.5 | 1.8 % | ||
| CVE-2020-35524 | libtiff 4.2.0 | A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF f | HIGH 7.8 | 1.9 % | ||
| CVE-2020-35523 | libtiff 4.2.0 | An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arb | HIGH 7.8 | 1.9 % | ||
| CVE-2020-35522 | libtiff 4.2.0 | In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial o | MEDIUM 5.5 | 1.6 % | ||
| CVE-2020-35521 | libtiff 4.2.0 | A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial | MEDIUM 5.5 | 1.2 % | ||
| CVE-2014-8128 | prior to 4.0.4 | LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denia | MEDIUM 6.5 | 3.9 % |