Description
Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.9.5-1 | — |
| Debian 13 | tiff | 3.9.5-1 | — |
| Debian 12 | tiff | 3.9.5-1 | — |
| Debian 6.0 | tiff | 3.9.4-5+squeeze2 | DSA-2256-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libtiff +2 | 3.9.4-1.el6_0.3 | RHSA-2011:0452 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- IrfanView - '.TIF' Image Decompression Buffer Overflow EDB-22681 · dos · Nov 13, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2011:0452 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2256-1 tiff - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110412 libtiff CVE assignments mailing-list
- DSA-2256 vendor-advisory
- libtiff-ojpeg-bo(66774) vdb-entry
- 44271 third-party-advisory
- http://bugzilla.maptools.org/show_bug.cgi?id=1999
- https://bugzilla.redhat.com/show_bug.cgi?id=695885
- 1025380 vdb-entry
- MDVSA-2011:078 vendor-advisory
- GLSA-201209-02 vendor-advisory
- FEDORA-2011-5304 vendor-advisory
- ADV-2011-1014 vdb-entry
- http://www.remotesensing.org/libtiff/v3.9.5.html
- ADV-2011-1082 vdb-entry
- 47338 vdb-entry
- USN-1120-1 vendor-advisory
- RHSA-2011:0452 vendor-advisory
- 50726 third-party-advisory