CVE-2023-3164
Heap-buffer-overflow in extractimagesection()
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Heap-buffer-overflow in extractimagesection()
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
CVE-2023-3164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-43847
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
EUVD-2023-43847- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2x8c-h7r9-r6m6
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to...
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.
- Record
GHSA-2x8c-h7r9-r6m6- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-120, CWE-125, CWE-787
- Updated
- 2026-11-02
NVD
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
CVE-2023-3164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120, CWE-787
- Updated
- 2026-11-02
OSVAZL-31765
CVE-2023-3164 affecting package libtiff for versions less than 4.6.0-5
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
AZL-31765- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-34952
CVE-2023-3164 affecting package libtiff for versions less than 4.6.0-5
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
AZL-34952- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 12 moreShow less
OSV
Heap-buffer-overflow in extractimagesection()
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
CVE-2023-3164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-3164
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
DEBIAN-CVE-2023-3164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2025-314
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at...
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
JLSEC-2025-314- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1663
libtiff security update
This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.
Security Fix(es):
A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.(CVE-2023-1916)
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.(CVE-2023-3164)
- Record
OESA-2024-1663- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-3164
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
- Record
UBUNTU-CVE-2023-3164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776349106 No score
libtiff: Fix of 5 CVEs
- CVE-2022-34526: fix stack buffer overflow in _TIFFVGetField via invalid codec-specific tag
- CVE-2023-2908: fix null pointer dereference in countInkNamesString in tif_dir.c
- CVE-2023-6277: prevent out-of-memory attacks by comparing allocation size with file size
- CVE-2023-1916: fix out-of-bounds read in extractImageSection in tiffcrop.c
- CVE-2023-3164: fix heap-buffer-overflow in extractImageSection in tiffcrop.c
- Record
CLSA-2026-1776349106- Updated
- 2026-11-02
OSVMGASA-2024-0213 No score
Updated libtiff packages fix security vulnerability
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. (CVE-2023-3164)
- Record
MGASA-2024-0213- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2023-3164 No score
CVE-2023-3164 in tiff - Patched by Root
Root has patched CVE-2023-3164 in the tiff package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2023-3164- Updated
- 2026-11-02
OSVSUSE-SU-2024:1892-1 No score
Security update for tiff
This update for tiff fixes the following issues:
- CVE-2023-3164: Fixed a heap buffer overflow in tiffcrop. (bsc#1212233)
- Record
SUSE-SU-2024:1892-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2028-1 No score
Security update for tiff
This update for tiff fixes the following issues:
- CVE-2023-3164: Fixed a heap buffer overflow in tiffcrop. (bsc#1212233)
- Record
SUSE-SU-2024:2028-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2028-2 No score
Security update for tiff
This update for tiff fixes the following issues:
- CVE-2023-3164: Fixed a heap buffer overflow in tiffcrop. (bsc#1212233)
- Record
SUSE-SU-2024:2028-2- Updated
- 2026-11-02
OSVUSN-6827-1 No score
tiff vulnerability
It was discovered that LibTIFF incorrectly handled memory when performing certain cropping operations, leading to a heap buffer overflow. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.
- Record
USN-6827-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libtiffAzure Linux:2 |
before 4.6.0-5 | 4.6.0-5 |
libtiffAzure Linux:3 |
before 4.6.0-5 | 4.6.0-5 |
libtiffTuxCare:AlmaLinux:9.6 From an advisory covering 5 CVEs |
before 4.4.0-13.el9_6.2.tuxcare.els6 | 4.4.0-13.el9_6.2.tuxcare.els6 |
libtiff-develTuxCare:AlmaLinux:9.6 From an advisory covering 5 CVEs |
before 4.4.0-13.el9_6.2.tuxcare.els6 | 4.4.0-13.el9_6.2.tuxcare.els6 |
libtiff-staticTuxCare:AlmaLinux:9.6 From an advisory covering 5 CVEs |
before 4.4.0-13.el9_6.2.tuxcare.els6 | 4.4.0-13.el9_6.2.tuxcare.els6 |
libtiff-toolsTuxCare:AlmaLinux:9.6 From an advisory covering 5 CVEs |
before 4.4.0-13.el9_6.2.tuxcare.els6 | 4.4.0-13.el9_6.2.tuxcare.els6 |
tiffDebian:12 |
All versions, plus listed versions 4.5.0-64.5.0-6+deb12u14.5.0-6+deb12u24.5.0-6+deb12u34.5.0-6+deb12u4 Show 18 moreShow less4.5.1+git230720-14.5.1+git230720-24.5.1+git230720-34.5.1+git230720-44.5.1+git230720-54.5.1-14.5.1~rc3-14.6.0-14.6.0-24.7.0-14.7.0-24.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1 |
None known |
tiffDebian:13 |
before 4.7.0-1 | 4.7.0-1 |
tiffDebian:14 |
before 4.7.0-1 | 4.7.0-1 |
Libtiff_jllJulia |
before 4.6.0+0 | 4.6.0+0 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libtiffMageia:9 |
before 4.5.1-1.4.mga9 | 4.5.1-1.4.mga9 |
libtiffopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 4.3.0-23.oe1 | 4.3.0-23.oe1 |
libtiffopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 4.3.0-23.oe2003sp4 | 4.3.0-23.oe2003sp4 |
libtiffopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 4.3.0-37.oe2203sp3 | 4.3.0-37.oe2203sp3 |
libtiffopenEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 4.3.0-37.oe2203sp1 | 4.3.0-37.oe2203sp1 |
libtiffopenEuler:22.03-LTS-SP2 From an advisory covering 2 CVEs |
before 4.3.0-37.oe2203sp2 | 4.3.0-37.oe2203sp2 |
libtiffopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 4.3.0-37.oe2203sp3 | 4.3.0-37.oe2203sp3 |
tiffRoot:Debian:12 |
before 4.5.0-6+deb12u4.aikido.20 | 4.5.0-6+deb12u4.aikido.204.5.0-6+deb12u4.root.io.194.5.0-6+deb12u4.aikido.214.5.0-6+deb12u4.aikido.22 |
rootio-tiffRoot:Debian:12 |
before 4.5.0-6+deb12u4.aikido.20 | 4.5.0-6+deb12u4.aikido.204.5.0-6+deb12u4.root.io.194.5.0-6+deb12u4.aikido.214.5.0-6+deb12u4.aikido.22 |
tiffSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 4.0.9-44.83.1 | 4.0.9-44.83.1 |
tiffSUSE:Linux Enterprise Server 12 SP5 |
before 4.0.9-44.83.1 | 4.0.9-44.83.1 |
tiffSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 4.0.9-44.83.1 | 4.0.9-44.83.1 |
tiffSUSE:Linux Enterprise Micro 5.3 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffSUSE:Linux Enterprise Micro 5.4 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffSUSE:Linux Enterprise Micro 5.5 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffSUSE:Linux Enterprise Micro 5.2 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffopenSUSE:Leap Micro 5.3 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffopenSUSE:Leap Micro 5.4 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffopenSUSE:Leap 15.5 |
before 4.0.9-150000.45.44.1 | 4.0.9-150000.45.44.1 |
tiffUbuntu:Pro:14.04:LTS |
before 4.0.3-7ubuntu0.11+esm13, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 22 moreShow less4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.104.0.3-7ubuntu0.114.0.3-7ubuntu0.11+esm14.0.3-7ubuntu0.11+esm24.0.3-7ubuntu0.11+esm34.0.3-7ubuntu0.11+esm44.0.3-7ubuntu0.11+esm54.0.3-7ubuntu0.11+esm64.0.3-7ubuntu0.11+esm74.0.3-7ubuntu0.11+esm84.0.3-7ubuntu0.11+esm94.0.3-7ubuntu0.11+esm104.0.3-7ubuntu0.11+esm114.0.3-7ubuntu0.11+esm12 |
4.0.3-7ubuntu0.11+esm13 |
tiffUbuntu:Pro:16.04:LTS |
before 4.0.6-1ubuntu0.8+esm16, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2 Show 20 moreShow less4.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.54.0.6-1ubuntu0.64.0.6-1ubuntu0.74.0.6-1ubuntu0.84.0.6-1ubuntu0.8+esm14.0.6-1ubuntu0.8+esm24.0.6-1ubuntu0.8+esm34.0.6-1ubuntu0.8+esm44.0.6-1ubuntu0.8+esm64.0.6-1ubuntu0.8+esm74.0.6-1ubuntu0.8+esm84.0.6-1ubuntu0.8+esm94.0.6-1ubuntu0.8+esm104.0.6-1ubuntu0.8+esm114.0.6-1ubuntu0.8+esm124.0.6-1ubuntu0.8+esm134.0.6-1ubuntu0.8+esm144.0.6-1ubuntu0.8+esm15 |
4.0.6-1ubuntu0.8+esm16 |
tiffUbuntu:Pro:18.04:LTS |
before 4.0.9-5ubuntu0.10+esm6, plus listed versions 4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3 Show 18 moreShow less4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.14.0.9-5ubuntu0.24.0.9-5ubuntu0.34.0.9-5ubuntu0.44.0.9-5ubuntu0.54.0.9-5ubuntu0.64.0.9-5ubuntu0.74.0.9-5ubuntu0.84.0.9-5ubuntu0.94.0.9-5ubuntu0.104.0.9-5ubuntu0.10+esm14.0.9-5ubuntu0.10+esm24.0.9-5ubuntu0.10+esm34.0.9-5ubuntu0.10+esm44.0.9-5ubuntu0.10+esm5 |
4.0.9-5ubuntu0.10+esm6 |
tiffUbuntu:20.04:LTS |
before 4.1.0+git191117-2ubuntu0.20.04.13, plus listed versions 4.0.10+git191003-14.1.0+git191117-14.1.0+git191117-24.1.0+git191117-2build14.1.0+git191117-2ubuntu0.20.04.1 Show 11 moreShow less4.1.0+git191117-2ubuntu0.20.04.24.1.0+git191117-2ubuntu0.20.04.34.1.0+git191117-2ubuntu0.20.04.44.1.0+git191117-2ubuntu0.20.04.54.1.0+git191117-2ubuntu0.20.04.64.1.0+git191117-2ubuntu0.20.04.74.1.0+git191117-2ubuntu0.20.04.84.1.0+git191117-2ubuntu0.20.04.94.1.0+git191117-2ubuntu0.20.04.104.1.0+git191117-2ubuntu0.20.04.114.1.0+git191117-2ubuntu0.20.04.12 |
4.1.0+git191117-2ubuntu0.20.04.13 |
tiffUbuntu:22.04:LTS |
before 4.3.0-6ubuntu0.9, plus listed versions 4.3.0-14.3.0-24.3.0-34.3.0-3build14.3.0-4 Show 10 moreShow less4.3.0-54.3.0-64.3.0-6ubuntu0.14.3.0-6ubuntu0.24.3.0-6ubuntu0.34.3.0-6ubuntu0.44.3.0-6ubuntu0.54.3.0-6ubuntu0.64.3.0-6ubuntu0.74.3.0-6ubuntu0.8 |
4.3.0-6ubuntu0.9 |
tiffUbuntu:24.04:LTS |
before 4.5.1+git230720-4ubuntu2.1, plus listed versions 4.5.1+git230720-1ubuntu14.5.1+git230720-3ubuntu14.5.1+git230720-4ubuntu14.5.1+git230720-4ubuntu2 |
4.5.1+git230720-4ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3164 is a medium vulnerability (CVSS 5.5) in Libtiff, published November 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in libtiff 4.6.0-5.
References
access.redhat.com/security/cve/CVE-2023-3164
bugzilla.redhat.com/show_bug.cgi?id=2213531
gitlab.com/libtiff/libtiff/-/issues/542
nvd.nist.gov/vuln/detail/CVE-2023-3164
Show 20 moreShow less
github.com/advisories/GHSA-2x8c-h7r9-r6m6
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776349106.html
packages.fedoraproject.org
security-tracker.debian.org/tracker/CVE-2023-3164
advisories.mageia.org/MGASA-2024-0213.html
bugs.mageia.org/show_bug.cgi?id=33267
lists.suse.com/pipermail/sle-security-updates/2024-June/018642.html
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1663
suse.com/support/update/announcement/2024/suse-su-20241892-1
bugzilla.suse.com/1212233
ubuntu.com/security/CVE-2023-3164
cve.org/CVERecord?id=CVE-2023-3164