CVE-2016-9535

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."

• CWE-119
• CWE-119

• http://rhn.redhat.com/errata/RHSA-2017-0225.html
• http://www.debian.org/security/2017/dsa-3844
• http://www.securityfocus.com/bid/94484Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/94744
• https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1Issue Tracking, Patch, Third Party Advisory
• https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33Issue Tracking, Patch, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0225.html
• http://www.debian.org/security/2017/dsa-3844
• http://www.securityfocus.com/bid/94484Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/94744
• https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1Issue Tracking, Patch, Third Party Advisory
• https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33Issue Tracking, Patch, Third Party Advisory

Published

Nov 22, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9529Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9530Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9531Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9532Integer overflow in the writeBufferToSeparateStrips function…
• CVE-2016-9533tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vuln…
• CVE-2016-9534tif_write.c in libtiff 4.0.6 has an issue in the error code …
• CVE-2016-9536tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vu…
• CVE-2016-9537tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vu…
• CVE-2016-9538tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer …
• CVE-2016-9539tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read …
• CVE-2016-9540tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write o…
• CVE-2016-9553The Sophos Web Appliance (version 4.2.1.3) is vulnerable to …