# CVE-2023-52356: libtiff heap buffer overflow in TIFFReadRGBATileExt

Source: https://junglewise.ai/threats/cve-2023-52356-libtiff-heap-buffer-overflow-in-tiffreadrgbatileext  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-25. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2023-52356 · Severity: high · CVSS 7.5 · Published 2024-01-25

A vulnerability was found in libtiff, a widely used library for processing TIFF image files. By providing a specially crafted image file, an attacker can cause the software to crash. This results in a denial of service, potentially disrupting applications or systems that automatically process image uploads or attachments.

Technologies: [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2023-52356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-52356 being exploited in the wild.

**How severe is CVE-2023-52356?** High severity, with a CVSS score of 7.5, published 25 January 2024.

**Which products and versions are affected?** Red Hat Enterprise Linux 8 8.10; Red Hat Enterprise Linux 9 9.7.

**Is there a fix for CVE-2023-52356?** A patch was published on 2024-08-07: Red Hat released security updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-52356 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-52356?** Check whether you run Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A segmentation fault (SEGV) flaw exists in libtiff within the TIFFReadRGBATileExt() API. The vulnerability is triggered when the library processes a maliciously crafted TIFF file, leading to a heap-based buffer overflow. This is an out-of-bounds write vulnerability (CWE-787/CWE-122). An attacker can exploit this remotely without authentication or user interaction to cause a denial of service (DoS) by crashing the application linked against libtiff. Patches have been released by the libtiff maintainers and various Linux distributions including Red Hat and Debian.

## Affected products

- libtiff libtiff 4.0.9, 4.4.0
- Red Hat Enterprise Linux 8 8.10
- Red Hat Enterprise Linux 9 9.7

## Timeline

- 2024-01-25: disclosed: Initial NVD publication date
- 2024-08-07: patched: Red Hat released security updates for RHEL 8
- 2025-11-11: patched: Red Hat released security updates for RHEL 9

## References

- [https://access.redhat.com/errata/RHSA-2024:5079](https://access.redhat.com/errata/RHSA-2024:5079)
- [https://access.redhat.com/errata/RHSA-2025:20801](https://access.redhat.com/errata/RHSA-2025:20801)
- [https://access.redhat.com/errata/RHSA-2025:21994](https://access.redhat.com/errata/RHSA-2025:21994)
- [https://access.redhat.com/errata/RHSA-2025:23078](https://access.redhat.com/errata/RHSA-2025:23078)
- [https://access.redhat.com/errata/RHSA-2025:23079](https://access.redhat.com/errata/RHSA-2025:23079)
- [https://access.redhat.com/errata/RHSA-2025:23080](https://access.redhat.com/errata/RHSA-2025:23080)
- [https://access.redhat.com/errata/RHSA-2026:16174](https://access.redhat.com/errata/RHSA-2026:16174)

## Related threats

- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)
- [Red Hat PCP privilege escalation in linux_sockets PMDA](https://junglewise.ai/threats/cve-2026-16526-red-hat-pcp-privilege-escalation-in-linux-sockets-pmda)