---
id: CVE-2023-52356
title: >-
  Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial
  of service
summary: >-
  A segment fault (SEGV) flaw was found in libtiff that could be triggered by
  passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows
  a remote attacker to cause a heap-buffer overflow, leading to a denial of
  service.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: Red Hat
product: libtiff
affected:
  - libtiff < 4.6.0
  - libtiff (all versions)
  - libtiff (all versions)
  - libtiff (all versions)
  - libtiff (all versions)
  - libtiff (all versions)
  - rhaiis/vllm-cuda-rhel9 (all versions)
  - rhaiis/vllm-rocm-rhel9 (all versions)
  - rhaiis/model-opt-cuda-rhel9 (all versions)
  - rhaiis/model-opt-cuda-rhel9 (all versions)
  - rhaiis/vllm-cuda-rhel9 (all versions)
  - rhaiis/vllm-rocm-rhel9 (all versions)
  - rhaiis/vllm-cuda-rhel9 (all versions)
  - rhaiis/vllm-spyre-rhel9 (all versions)
  - rhaiis/vllm-cuda-rhel9 (all versions)
  - rhaiis/vllm-rocm-rhel9 (all versions)
  - rhaiis/model-opt-cuda-rhel9 (all versions)
  - discovery/discovery-ui-rhel9 (all versions)
  - libtiff
  - compat-libtiff3
  - libtiff
  - compat-libtiff3 (all versions)
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2024-01-28T01:27:48.546657Z'
exploitAvailable: true
published: '2024-01-25'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T06:16:47.321Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-52356'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:5079'
    label: 'RHSA-2024:5079'
  - url: 'https://access.redhat.com/errata/RHSA-2025:20801'
    label: 'RHSA-2025:20801'
  - url: 'https://access.redhat.com/errata/RHSA-2025:21994'
    label: 'RHSA-2025:21994'
  - url: 'https://access.redhat.com/errata/RHSA-2025:23078'
    label: 'RHSA-2025:23078'
  - url: 'https://access.redhat.com/errata/RHSA-2025:23079'
    label: 'RHSA-2025:23079'
  - url: 'https://access.redhat.com/errata/RHSA-2025:23080'
    label: 'RHSA-2025:23080'
  - url: 'https://access.redhat.com/errata/RHSA-2026:16174'
    label: 'RHSA-2026:16174'
  - url: 'https://access.redhat.com/errata/RHSA-2026:25096'
    label: 'RHSA-2026:25096'
  - url: 'https://access.redhat.com/errata/RHSA-2026:3461'
    label: 'RHSA-2026:3461'
  - url: 'https://access.redhat.com/errata/RHSA-2026:3462'
    label: 'RHSA-2026:3462'
  - url: 'https://access.redhat.com/errata/RHSA-2026:5958'
    label: 'RHSA-2026:5958'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7081'
    label: 'RHSA-2026:7081'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7304'
    label: 'RHSA-2026:7304'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7335'
    label: 'RHSA-2026:7335'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8746'
    label: 'RHSA-2026:8746'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8747'
    label: 'RHSA-2026:8747'
  - url: 'https://access.redhat.com/errata/RHSA-2026:8748'
    label: 'RHSA-2026:8748'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-52356'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2251344'
    label: RHBZ#2251344
  - url: 'https://gitlab.com/libtiff/libtiff/-/issues/622'
  - url: 'https://gitlab.com/libtiff/libtiff/-/merge_requests/546'
tags:
  - cve.org
  - exploit-available
epss: 0.02222
epssPercentile: 0.82791
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/yardenbenita/CVE-2023-52356-libtiff-analysis'
  checkedAt: '2026-11-07T17:43:45.904Z'
ingestedAt: '2026-11-07T07:12:31.883Z'
---

## Overview

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

## Affected

- `libtiff < 4.6.0`
- `libtiff (all versions)`
- `libtiff (all versions)`
- `libtiff (all versions)`
- `libtiff (all versions)`
- `libtiff (all versions)`
- `rhaiis/vllm-cuda-rhel9 (all versions)`
- `rhaiis/vllm-rocm-rhel9 (all versions)`
- `rhaiis/model-opt-cuda-rhel9 (all versions)`
- `rhaiis/model-opt-cuda-rhel9 (all versions)`
- `rhaiis/vllm-cuda-rhel9 (all versions)`
- `rhaiis/vllm-rocm-rhel9 (all versions)`
- `rhaiis/vllm-cuda-rhel9 (all versions)`
- `rhaiis/vllm-spyre-rhel9 (all versions)`
- `rhaiis/vllm-cuda-rhel9 (all versions)`
- `rhaiis/vllm-rocm-rhel9 (all versions)`
- `rhaiis/model-opt-cuda-rhel9 (all versions)`
- `discovery/discovery-ui-rhel9 (all versions)`
- `libtiff`
- `compat-libtiff3`
- `libtiff`
- `compat-libtiff3 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.