---
id: CVE-2023-1916
title: 'A flaw was found in tiffcrop, a program distributed by the libtiff package'
summary: >-
  A flaw was found in tiffcrop, a program distributed by the libtiff package. A
  specially crafted tiff file can lead to an out-of-bounds read in the
  extractImageSection function in tools/tiffcrop.c, resulting in a denial of
  service and lim…
severity: none
cwe:
  - CWE-125
product: libtiff
affected:
  - libtiff libtiff versions 4.x and newer are affected
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T21:09:39.385939Z'
published: '2023-04-10'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T22:17:39.760Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-1916'
references:
  - url: 'https://gitlab.com/libtiff/libtiff/-/issues/536%2C'
  - url: 'https://gitlab.com/libtiff/libtiff/-/issues/537'
  - url: 'https://support.apple.com/kb/HT213844'
tags:
  - cve.org
epss: 0.00365
epssPercentile: 0.30561
ingestedAt: '2026-11-05T19:30:42.874Z'
---

## Overview

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

## Affected

- `libtiff libtiff versions 4.x and newer are affected`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.