Description
Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.8.2-3 | — |
| Debian 13 | tiff | 3.8.2-3 | — |
| Debian 12 | tiff | 3.8.2-3 | — |
| Debian 3.1 | tiff | 3.7.2-5 | DSA-1091-1 |
| Debian 3.0 | tiff | 3.5.5-7woody2 | DSA-1091-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | libtiff +1 | 3.6.1-12 | RHSA-2006:0603 |
| RHEL 3 | libtiff +1 | 3.5.7-25.el3.4 | RHSA-2006:0603 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.3.0-1.3 | openSUSE-SU-2024:11461-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow EDB-1831 · local · May 26, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2006:0603 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1091-1 tiff - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11461-1 libtiff-devel-32bit-4.3.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2006-591 vendor-advisory
- 20520 third-party-advisory
- 20766 third-party-advisory
- GLSA-200607-03 vendor-advisory
- 20501 third-party-advisory
- DSA-1091 vendor-advisory
- SUSE-SR:2006:014 vendor-advisory
- MDKSA-2006:095 vendor-advisory
- 21002 third-party-advisory
- 20060524 tiffsplit (libtiff <= 3.8.2) bss & stack buffer overflow... mailing-list
- USN-289-1 vendor-advisory