CVE-2022-3626

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.4.0

Description The issue is related to an out-of-bounds write in the TIFFmemset function, allowing attackers to cause a denial-of-service via a crafted tiff file. This can be triggered when the TIFFmemset function is called from processCropSelections in tools/tiffcrop.c:7619. The vulnerability is associated with a memory buffer overflow.

Recommendations For LibTIFF version 4.4.0, users who compile libtiff from sources can apply the fix available with commit 236b7191. As a temporary workaround, consider restricting the use of crafted tiff files to minimize the risk of exploitation.