{"id":"CVE-2023-52356","title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial of service","summary":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-122"],"vendor":"Red Hat","product":"libtiff","affected":["libtiff < 4.6.0","libtiff (all versions)","libtiff (all versions)","libtiff (all versions)","libtiff (all versions)","libtiff (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhaiis/vllm-spyre-rhel9 (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","discovery/discovery-ui-rhel9 (all versions)","libtiff","compat-libtiff3","libtiff","compat-libtiff3 (all versions)"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2024-01-28T01:27:48.546657Z"},"exploitAvailable":true,"published":"2024-01-25","updated":"2026-11-07","sourceUpdated":"2026-11-07T06:16:47.321Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-52356","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:5079","label":"RHSA-2024:5079"},{"url":"https://access.redhat.com/errata/RHSA-2025:20801","label":"RHSA-2025:20801"},{"url":"https://access.redhat.com/errata/RHSA-2025:21994","label":"RHSA-2025:21994"},{"url":"https://access.redhat.com/errata/RHSA-2025:23078","label":"RHSA-2025:23078"},{"url":"https://access.redhat.com/errata/RHSA-2025:23079","label":"RHSA-2025:23079"},{"url":"https://access.redhat.com/errata/RHSA-2025:23080","label":"RHSA-2025:23080"},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","label":"RHSA-2026:16174"},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","label":"RHSA-2026:25096"},{"url":"https://access.redhat.com/errata/RHSA-2026:3461","label":"RHSA-2026:3461"},{"url":"https://access.redhat.com/errata/RHSA-2026:3462","label":"RHSA-2026:3462"},{"url":"https://access.redhat.com/errata/RHSA-2026:5958","label":"RHSA-2026:5958"},{"url":"https://access.redhat.com/errata/RHSA-2026:7081","label":"RHSA-2026:7081"},{"url":"https://access.redhat.com/errata/RHSA-2026:7304","label":"RHSA-2026:7304"},{"url":"https://access.redhat.com/errata/RHSA-2026:7335","label":"RHSA-2026:7335"},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","label":"RHSA-2026:8746"},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","label":"RHSA-2026:8747"},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","label":"RHSA-2026:8748"},{"url":"https://access.redhat.com/security/cve/CVE-2023-52356"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251344","label":"RHBZ#2251344"},{"url":"https://gitlab.com/libtiff/libtiff/-/issues/622"},{"url":"https://gitlab.com/libtiff/libtiff/-/merge_requests/546"}],"tags":["cve.org","exploit-available"],"epss":0.02222,"epssPercentile":0.82791,"exploits":{"github":1,"githubRepos":["https://github.com/yardenbenita/CVE-2023-52356-libtiff-analysis"],"checkedAt":"2026-11-07T17:43:45.904Z"},"ingestedAt":"2026-11-07T07:12:31.883Z","slug":"CVE-2023-52356","body":"## Overview\n\nA segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.\n\n## Affected\n\n- `libtiff < 4.6.0`\n- `libtiff (all versions)`\n- `libtiff (all versions)`\n- `libtiff (all versions)`\n- `libtiff (all versions)`\n- `libtiff (all versions)`\n- `rhaiis/vllm-cuda-rhel9 (all versions)`\n- `rhaiis/vllm-rocm-rhel9 (all versions)`\n- `rhaiis/model-opt-cuda-rhel9 (all versions)`\n- `rhaiis/model-opt-cuda-rhel9 (all versions)`\n- `rhaiis/vllm-cuda-rhel9 (all versions)`\n- `rhaiis/vllm-rocm-rhel9 (all versions)`\n- `rhaiis/vllm-cuda-rhel9 (all versions)`\n- `rhaiis/vllm-spyre-rhel9 (all versions)`\n- `rhaiis/vllm-cuda-rhel9 (all versions)`\n- `rhaiis/vllm-rocm-rhel9 (all versions)`\n- `rhaiis/model-opt-cuda-rhel9 (all versions)`\n- `discovery/discovery-ui-rhel9 (all versions)`\n- `libtiff`\n- `compat-libtiff3`\n- `libtiff`\n- `compat-libtiff3 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[]}