Skip to content
Fencer Intel
high 7.5

CVE-2023-52355 json

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

published 2y ago modified 5d ago also EUVD-2023-57011 , JLSEC-2025-315

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

Patch / fix

  • julia Libtiff_jll 4.6.0+0
  • libtiff libtiff 4.6.0
  • Red Hat Red Hat Enterprise Linux 10 0:4.6.0-8.el10_2.4
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.6.0-6.el10_0.4
  • Red Hat Red Hat Enterprise Linux 9 0:4.4.0-15.el9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.4.0-13.el9_6.5
  • Red Hat Red Hat AI Inference Server 3.2 3.2.2-1764871796, 3.2.2-1765379049, 3.2.2-1765379088, 1772160593, 1772160625
  • Red Hat Red Hat Discovery 2 2.4.0-1763656152
  • Red Hat Red Hat OpenShift AI 3.0 1790276884, 1790276886, 1790276889, 1790276974, 1790277045
  • Red Hat Red Hat OpenShift AI 3.2 1790703494, 1790703497, 1790703506, 1790703568, 1790703586, 1790703590
  • Red Hat Red Hat OpenShift AI 3.4 1790703542
  • tiff Debian 14, Debian 13 4.5.1+git230720-4

debian advisories DEBIAN-CVE-2023-52355

  • libtiff RHEL 10.2 4.6.0-8.el10_2.4
  • libtiff-tools RHEL 10.2 4.6.0-8.el10_2.4
  • libtiff RHEL 9 4.4.0-15.el9
  • libtiff-tools RHEL 9 4.4.0-15.el9
  • libtiff enterprise linux eus 10.0 4.6.0-6.el10_0.4
  • libtiff-tools enterprise linux eus 10.0 4.6.0-6.el10_0.4
  • libtiff RHEL 9.6 EUS 4.4.0-13.el9_6.5
  • libtiff-tools RHEL 9.6 EUS 4.4.0-13.el9_6.5

red hat advisories RHSA-2026:49671RHSA-2026:43537RHSA-2026:41892RHSA-2025:20801

  • libtiff AlmaLinux 10 4.6.0-8.el10_2.4
  • libtiff-tools AlmaLinux 10 4.6.0-8.el10_2.4

almalinux advisories ALSA-2026:41892

  • libtiff Rocky Linux 10 4.6.0-8.el10_2.4
  • libtiff Rocky Linux 9 4.4.0-15.el9_7.2.0.1

rocky linux advisories RLSA-2026:41892RLSA-2025:20801

Is CVE-2023-52355 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-52355 updated cvss 7.5

libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM

  • Red Hat Enterprise Linux 6 libtiff Red Hat Enterprise Linux 7 libtiff, libtiff-tools, compat-libtiff3
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 libtiff, libtiff-tools, compat-libtiff3
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat AI Inference Server 3.2 rhaiis 1772160593, rhaiis 1772160625, rhaiis 3.2.2-1764871796, rhaiis 3.2.2-1765379049, rhaiis 3.2.2-1765379088
    fixed: vendor fix RHSA-2025:23080
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libtiff-tools 4.4.0-13.el9_6.5
    fixed: vendor fix RHSA-2026:43537
  • Red Hat Discovery 2 discovery 2.4.0-1763656152
    fixed: vendor fix RHSA-2025:21994
  • Red Hat Enterprise Linux AppStream (v. 9) libtiff 4.4.0-15.el9
    fixed: vendor fix RHSA-2025:20801
  • Red Hat Enterprise Linux AppStream (v. 10) libtiff 4.6.0-8.el10_2.4
    fixed: vendor fix RHSA-2026:41892
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libtiff 4.6.0-6.el10_0.4
    fixed: vendor fix RHSA-2026:49671
show 8 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libtiff 4.4.0-13.el9_6.5
    fixed: vendor fix RHSA-2026:43537
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libtiff-tools 4.4.0-15.el9
    fixed: vendor fix RHSA-2025:20801
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libtiff-tools 4.6.0-8.el10_2.4
    fixed: vendor fix RHSA-2026:41892
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libtiff-tools 4.6.0-6.el10_0.4
    fixed: vendor fix RHSA-2026:49671
  • Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1790277045, rhai/base-image-tpu-rhel9 1790276884, rhai/base-image-cuda-rhel9 1790276974, rhai/base-image-rocm-rhel9 1790276886, rhai/base-image-spyre-rhel9 1790276889
    fixed: vendor fix RHSA-2026:73960
  • Red Hat OpenShift AI 3.2 rhai/base-image-cpu-rhel9 1790703590, rhai/base-image-tpu-rhel9 1790703497, rhai/base-image-cuda-rhel9 1790703586, rhai/base-image-rocm-rhel9 1790703494, rhai/base-image-rocm-rhel9 1790703506, rhai/base-image-spyre-rhel9 1790703568
    fixed: vendor fix RHSA-2026:74460
  • Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542
    fixed: vendor fix RHSA-2026:74674
  • Red Hat Discovery 2 discovery 2.4.0-1763596485
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

1.83% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-14).

Exploits and checks

  • gitlab.com https://gitlab.com/libtiff/libtiff/-/issues/621 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia Libtiff_jll
<4.6.0+0
4.6.0+0

Affected products

  • libtiff libtiff
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat OpenShift AI 3.0
  • Red Hat Red Hat OpenShift AI 3.2
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.