Executive brief
libtiff is a widely-used library for processing TIFF image files, relied upon by many image editing and document processing applications. An integer overflow vulnerability in the tiffcrop utility allows an attacker to bypass input validation by supplying specially crafted column and row values, leading to arbitrary code execution when processing a malicious TIFF file. This could enable attackers to compromise systems that process untrusted TIFF images.
Technical details
The vulnerability is an integer overflow in the process_command_opts() function within tools/tiffcrop.c. The -S option accepts cols×rows parameters and checks that their product does not exceed MAX_SECTIONS (32) using unsigned 32-bit multiplication; however, the multiplication itself can overflow (e.g., 65536 × 524288 wraps to 8), causing the validation check to pass while large cols/rows values remain stored in memory. The same vulnerable multiplication is later used in writeImageSections(), allowing an attacker to trigger out-of-bounds memory access. An attacker can exploit this by providing a crafted TIFF file with specific -S parameters, bypassing the bounds check and leading to arbitrary code execution. The vulnerability affects libtiff 4.7.1 and potentially earlier versions.
Affected products
- libtiff libtiff 4.7.1 and earlier
Timeline
- 2026-08-24: disclosed