CVE-2017-10688

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array...

7.5 HighPublic exploitFix available

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

7.36%Down 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: CVE-2017-10688
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: CVE-2017-10688
Updated: 2026-11-02

EUVDEUVD-2017-2335 No score

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: EUVD-2017-2335
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r4mr-x84x-xpx9 7.5

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array...

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: GHSA-r4mr-x84x-xpx9
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSVALPINE-CVE-2017-10688 7.5

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: ALPINE-CVE-2017-10688
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2017-10688 7.5

CVE-2017-10688 does not affect BellSoft software

Record: BELL-CVE-2017-10688
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSV 7.5

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: CVE-2017-10688
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-10688 7.5

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: DEBIAN-CVE-2017-10688
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-10688 7.5

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.

Record: UBUNTU-CVE-2017-10688
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2017-0210 No score

Updated libtiff packages fix security vulnerabilities

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code (CVE-2017-9936, CVE-2017-10688).

Record: MGASA-2017-0210
Updated: 2026-11-02

OSVUSN-3602-1 No score

tiff vulnerabilities

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Record: USN-3602-1
Updated: 2026-11-02

Affected products

libtiff

Affected packages

Affected packages
Package	Affected	Fixed
`tiff` Alpine:v3.10	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.11	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.12	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.13	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.14	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.15	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.16	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.17	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.18	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.19	before 4.0.8-r1	4.0.8-r1

Show 21 moreShow less

Affected packages
Package	Affected	Fixed
`tiff` Alpine:v3.20	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.21	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.22	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.23	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.24	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.3	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.4	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.5	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.6	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.7	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.8	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.9	before 4.0.8-r1	4.0.8-r1
`tiff` Debian:12	before 4.0.8-3	4.0.8-3
`tiff` Debian:13	before 4.0.8-3	4.0.8-3
`tiff` Debian:14	before 4.0.8-3	4.0.8-3
`tiff` Debian:7	before 4.0.2-6+deb7u15, plus listed versions 4.0.2-64.0.2-6+deb7u14.0.2-6+deb7u104.0.2-6+deb7u114.0.2-6+deb7u12 Show 10 moreShow less 4.0.2-6+deb7u134.0.2-6+deb7u144.0.2-6+deb7u24.0.2-6+deb7u34.0.2-6+deb7u44.0.2-6+deb7u54.0.2-6+deb7u64.0.2-6+deb7u74.0.2-6+deb7u84.0.2-6+deb7u9	4.0.2-6+deb7u15
`tiff` Debian:8	before 4.0.3-12.3+deb8u4, plus listed versions 4.0.3-12.34.0.3-12.3+deb8u14.0.3-12.3+deb8u24.0.3-12.3+deb8u3	4.0.3-12.3+deb8u4
`tiff` Debian:9	before 4.0.8-2+deb9u1, plus listed versions 4.0.8-2	4.0.8-2+deb9u1
`libtiff` Mageia:5	before 4.0.8-1.1.mga5	4.0.8-1.1.mga5
`tiff` Ubuntu:14.04:LTS	before 4.0.3-7ubuntu0.8, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 6 moreShow less 4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.7	4.0.3-7ubuntu0.8
`tiff` Ubuntu:16.04:LTS	before 4.0.6-1ubuntu0.3, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2	4.0.6-1ubuntu0.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	LibTIFF - 'tif_dirwrite.c' Denial of Service	2017-07-06

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-10688 is a high vulnerability (CVSS 7.5) in Libtiff, published June 29, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.36%, the 94th percentile. Fixed in tiff 4.0.8-r1.

References

Show 35 moreShow less