Description

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T18:16:56.690Z",
  "pubdate": "2026-09-11T18:16:56.690Z",
  "executiveSummary": "A heap-buffer overflow vulnerability has been identified within the tiff2pdf utility of the libtiff library, originating from an integer truncation error during the processing of BigTIFF files.\nThe vulnerability occurs when a 64-bit StripByteCounts value is improperly truncated to a 32-bit integer, leading to an insufficient heap memory allocation.\nAn unauthenticated attacker can exploit this flaw by providing a maliciously crafted BigTIFF file, which triggers a subsequent out-of-bounds memory copy.\nThe successful exploitation of this vulnerability results in severe memory corruption, which can lead to application crashes, potential arbitrary code execution, or unauthorized information disclosure.\nThis issue poses a significant risk to systems that process untrusted image files using libtiff, as it requires no specific user interaction beyond opening or processing the tainted file.",
  "technicalDetails": "The vulnerability resides within the tiff2pdf utility, specifically in the logic responsible for handling the StripByteCounts tag in BigTIFF file formats.\nThe root cause is an integer truncation flaw that manifests during the conversion or processing of the StripByteCounts field. BigTIFF files support 64-bit offsets and counts; however, the tiff2pdf utility erroneously narrows these 64-bit values to 32-bit integers during data handling.\nWhen a BigTIFF file contains a StripByteCounts value exceeding the capacity of a 32-bit integer, the truncation causes the value to wrap around to a significantly smaller number.\nThis truncated value is subsequently used as the operand for memory allocation functions (such as malloc or calloc). Because the allocated buffer size is calculated based on the truncated (smaller) integer rather than the actual required size defined by the 64-bit metadata, the program allocates insufficient memory on the heap.\nFollowing the undersized allocation, the application proceeds to copy the source data from the image file into the heap buffer. Because the source buffer is larger than the destination buffer, the write operation continues beyond the memory region allocated for the buffer, triggering a heap-based buffer overflow.\nThis out-of-bounds memory copy facilitates the corruption of adjacent heap metadata and surrounding data structures. Depending on the memory layout, this corruption can be leveraged to overwrite function pointers, return addresses, or other critical data structures, potentially leading to controlled execution flow redirection.\nExploitation is achieved by delivering a crafted BigTIFF file to an application linked against a vulnerable version of libtiff. The tiff2pdf utility processes the file automatically, meaning the attack does not require prior authentication or elevated privileges. The impact is primarily dictated by the target application's runtime context; however, given the nature of heap corruption, this vulnerability is categorized as high-severity due to its potential for arbitrary code execution."
}