CVE-2018-5360

Name: CVE-2018-5360
Creator: NVD / NIST
Published: 2018-01-14T02:29:04.667+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.82%

Last modified Jun 17, 2026

CVE-2018-5360 is a vulnerability of currently unknown severity. LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.. EPSS estimates a 1.82% chance of exploitation in the next 30 days.

Description

LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.

Metrics

EPSS Probability

1.82%

76.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-125

Affected Software

Vendor	Product	Versions
Libtiff	Libtiff	< 4.0.6
Graphicsmagick	Graphicsmagick	1.3.27

References

http://bugzilla.maptools.org/show_bug.cgi?id=2500Exploit, Issue Tracking, Third Party Advisory
https://gitlab.com/libtiff/libtiff/commit/739dcd28a061738b317c1e9f91029d9cbc157159Patch, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/540/Exploit, Issue Tracking, Third Party Advisory
http://bugzilla.maptools.org/show_bug.cgi?id=2500Exploit, Issue Tracking, Third Party Advisory
https://gitlab.com/libtiff/libtiff/commit/739dcd28a061738b317c1e9f91029d9cbc157159Patch, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/540/Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jan 14, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-5360?

LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.

How severe is CVE-2018-5360?

Severity scoring for CVE-2018-5360 is pending analysis. The EPSS model estimates a 1.82% probability of exploitation in the next 30 days.

How do I fix CVE-2018-5360?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →

Are you affected by CVE-2018-5360?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST