Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

LibTIFF Image Processing Software Allows Remote Attack via Malformed Image

CVE-2016-10093 · published 9 years ago
Summary

LibTIFF, a software used to process image files, contains a flaw that allows an attacker to cause unexpected behavior by sending a specially crafted image. This could potentially lead to security problems, but the exact impact is not yet known. Update to the latest version to resolve this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
libtiff libtiff 4.0.7
cpe:2.3:a:libtiff:libtiff:4.0.7:*:*:*:*:*:*:*
Original advisory text
Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4....
Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-190Integer Overflow
Timeline
Published1 Mar 2017
Updated4 Nov 2026
First seen2 Apr 2026
Sources
CVE-2016-10093 · OSV
CVE-2016-10093 · NVD
Track software like this
Free during beta