Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

Summary

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

Timeline

1. Jan 25, 2024, 8:03 PM UTCCVE published
2. Feb 21, 2024, 6:49 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 2, 2026, 2:19 AM UTCRecord last updated

Affected versions

• libtiff

  fixed in 4.6.0

• libtiff

  Version range not reported

• libtiff

  Version range not reported

• libtiff

  Version range not reported

• libtiff

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• libtiff

  Version range not reported

• compat-libtiff3

  Version range not reported

• libtiff

  Version range not reported

• compat-libtiff3

  Version range not reported

• libtiff

  Version range not reported

References 25