CVE-2023-52356

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
References
Link Resource
https://access.redhat.com/errata/RHSA-2024:5079 Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:20801 Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:21994 Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:23078 Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:23079 Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:23080 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:16174 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:25096 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3461 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3462 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5958 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7081 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7304 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7335 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:8746 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:8747 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:8748 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-52356 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2251344 Issue Tracking Vendor Advisory
https://gitlab.com/libtiff/libtiff/-/issues/622 Issue Tracking Patch Exploit
https://gitlab.com/libtiff/libtiff/-/merge_requests/546 Issue Tracking Patch
http://seclists.org/fulldisclosure/2024/Jul/16 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/17 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/21 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/22 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/23 Mailing List Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-52356 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2251344 Issue Tracking Vendor Advisory
https://gitlab.com/libtiff/libtiff/-/issues/622 Issue Tracking Patch Exploit
https://gitlab.com/libtiff/libtiff/-/merge_requests/546 Issue Tracking Patch
https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html Mailing List Third Party Advisory
https://support.apple.com/kb/HT214116 Third Party Advisory
https://support.apple.com/kb/HT214117 Third Party Advisory
https://support.apple.com/kb/HT214118 Third Party Advisory
https://support.apple.com/kb/HT214119 Third Party Advisory
https://support.apple.com/kb/HT214120 Third Party Advisory
https://support.apple.com/kb/HT214122 Third Party Advisory
https://support.apple.com/kb/HT214123 Third Party Advisory
https://support.apple.com/kb/HT214124 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ai_inference_server:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*

History

28 Oct 2026, 19:06

Type Values Removed Values Added
First Time Apple
Debian debian Linux
Redhat enterprise Linux Eus
Redhat discovery
Apple visionos
Redhat codeready Linux Builder Eus
Redhat codeready Linux Builder
Apple watchos
Apple iphone Os
Redhat ai Inference Server
Apple ipados
Apple tvos
Apple macos
Debian
References () https://access.redhat.com/errata/RHSA-2024:5079 - () https://access.redhat.com/errata/RHSA-2024:5079 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2025:20801 - () https://access.redhat.com/errata/RHSA-2025:20801 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2025:21994 - () https://access.redhat.com/errata/RHSA-2025:21994 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2025:23078 - () https://access.redhat.com/errata/RHSA-2025:23078 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2025:23079 - () https://access.redhat.com/errata/RHSA-2025:23079 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2025:23080 - () https://access.redhat.com/errata/RHSA-2025:23080 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:16174 - () https://access.redhat.com/errata/RHSA-2026:16174 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:25096 - () https://access.redhat.com/errata/RHSA-2026:25096 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:3461 - () https://access.redhat.com/errata/RHSA-2026:3461 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:3462 - () https://access.redhat.com/errata/RHSA-2026:3462 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:5958 - () https://access.redhat.com/errata/RHSA-2026:5958 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:7081 - () https://access.redhat.com/errata/RHSA-2026:7081 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:7304 - () https://access.redhat.com/errata/RHSA-2026:7304 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:7335 - () https://access.redhat.com/errata/RHSA-2026:7335 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:8746 - () https://access.redhat.com/errata/RHSA-2026:8746 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:8747 - () https://access.redhat.com/errata/RHSA-2026:8747 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2026:8748 - () https://access.redhat.com/errata/RHSA-2026:8748 - Vendor Advisory
References () https://access.redhat.com/security/cve/CVE-2023-52356 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-52356 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2251344 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2251344 - Issue Tracking, Vendor Advisory
References () https://gitlab.com/libtiff/libtiff/-/issues/622 - Issue Tracking, Patch () https://gitlab.com/libtiff/libtiff/-/issues/622 - Issue Tracking, Patch, Exploit
References () http://seclists.org/fulldisclosure/2024/Jul/16 - () http://seclists.org/fulldisclosure/2024/Jul/16 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/17 - () http://seclists.org/fulldisclosure/2024/Jul/17 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/18 - () http://seclists.org/fulldisclosure/2024/Jul/18 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/19 - () http://seclists.org/fulldisclosure/2024/Jul/19 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/20 - () http://seclists.org/fulldisclosure/2024/Jul/20 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/21 - () http://seclists.org/fulldisclosure/2024/Jul/21 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/22 - () http://seclists.org/fulldisclosure/2024/Jul/22 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/23 - () http://seclists.org/fulldisclosure/2024/Jul/23 - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html - () https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html - () https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html - Mailing List, Third Party Advisory
References () https://support.apple.com/kb/HT214116 - () https://support.apple.com/kb/HT214116 - Third Party Advisory
References () https://support.apple.com/kb/HT214117 - () https://support.apple.com/kb/HT214117 - Third Party Advisory
References () https://support.apple.com/kb/HT214118 - () https://support.apple.com/kb/HT214118 - Third Party Advisory
References () https://support.apple.com/kb/HT214119 - () https://support.apple.com/kb/HT214119 - Third Party Advisory
References () https://support.apple.com/kb/HT214120 - () https://support.apple.com/kb/HT214120 - Third Party Advisory
References () https://support.apple.com/kb/HT214122 - () https://support.apple.com/kb/HT214122 - Third Party Advisory
References () https://support.apple.com/kb/HT214123 - () https://support.apple.com/kb/HT214123 - Third Party Advisory
References () https://support.apple.com/kb/HT214124 - () https://support.apple.com/kb/HT214124 - Third Party Advisory
CPE cpe:2.3:a:libtiff:libtiff:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ai_inference_server:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*

Information

Published : 2024-01-25 20:15

Updated : 2026-10-28 19:06


NVD link : CVE-2023-52356

Mitre link : CVE-2023-52356

CVE.ORG link : CVE-2023-52356


JSON object : View

Products Affected

apple

  • macos
  • iphone_os
  • watchos
  • ipados
  • tvos
  • visionos

redhat

  • enterprise_linux_eus
  • ai_inference_server
  • codeready_linux_builder_eus
  • codeready_linux_builder
  • enterprise_linux
  • discovery

debian

  • debian_linux

libtiff

  • libtiff
CWE
CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write