An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
CVE-2023-6277
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-400
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
libtiff libtiff
fedoraproject fedora
References
- access.redhat.com Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Patch, Third Party Advisory
- gitlab.com Exploit, Issue Tracking, Patch
- gitlab.com Patch, Vendor Advisory
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org