A TIFF tag that points past the file makes libtiff allocate for nothing
An out-of-memory flaw in libtiff: a crafted file passed to TIFFOpen() makes it allocate from a tag's declared size.
- Advisory
- CVE-2023-6277 (also GHSA-fq8g-55cp-756j)
- Library
- libtiff, tiff on Debian
- Published
- Severity
- 7.5 out of 10, as published
- Affected
- libtiff before 4.6.0 (as packaged)
- Fixed in
- see the upstream record
- Reaches you
- by opening a file
What triggers it
Opening a TIFF whose directory declares a tag with a count that puts its data beyond the end of the file.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the max_metadata_bytes check.
Every tag's out-of-line data is checked to lie inside the file before anything decodes, and the largest block is held to max_metadata_bytes.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Keep libtiff current; it is the TIFF reader under Pillow, poppler and most of the rest.
Specifically. Check tag offsets and sizes against the file size before opening; sillybos does.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-fq8g-55cp-756j
- The record entry, triaged 2026-11-01, last checked 2026-11-01