Last updated 25 August 2025

TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tifdirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

LibTIFF is vulnerable to a denial of service, caused by a heap-based buffer overflow in TIFFmemcpy at tifunix.c when parsing TIFF files. By persuading a victim to open a specially crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.