---
id: CVE-2024-7006
title: 'Libtiff: null pointer dereference in tif_dirinfo.c'
summary: >-
  A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This
  issue may allow an attacker to trigger memory allocation failures through
  certain means, such as restricting the heap space size or injecting faults,
  causing …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
vendor: Red Hat
product: libtiff
affected:
  - libtiff
  - libtiff (all versions)
  - libtiff (all versions)
  - libtiff (all versions)
  - libtiff
  - libtiff
  - libtiff
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2025-06-03T02:10:18.944536Z'
published: '2024-08-08'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T14:43:49.738Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-7006'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:6360'
    label: 'RHSA-2024:6360'
  - url: 'https://access.redhat.com/errata/RHSA-2024:8833'
    label: 'RHSA-2024:8833'
  - url: 'https://access.redhat.com/errata/RHSA-2024:8914'
    label: 'RHSA-2024:8914'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-7006'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2302996'
    label: RHBZ#2302996
tags:
  - cve.org
epss: 0.01516
epssPercentile: 0.74592
ingestedAt: '2026-11-05T21:36:00.881Z'
---

## Overview

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

## Affected

- `libtiff`
- `libtiff (all versions)`
- `libtiff (all versions)`
- `libtiff (all versions)`
- `libtiff`
- `libtiff`
- `libtiff`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.