CVE-2023-2731

A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.

• CWE-476
• CWE-476

• https://access.redhat.com/security/cve/CVE-2023-2731Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2207635Issue Tracking, Patch, Third Party Advisory
• https://github.com/libsdl-org/libtiff/commit/9be22b639ea69e102d3847dca4c53ef025e9527bPatch
• https://gitlab.com/libtiff/libtiff/-/issues/548Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230703-0009/
• https://access.redhat.com/security/cve/CVE-2023-2731Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2207635Issue Tracking, Patch, Third Party Advisory
• https://github.com/libsdl-org/libtiff/commit/9be22b639ea69e102d3847dca4c53ef025e9527bPatch
• https://gitlab.com/libtiff/libtiff/-/issues/548Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230703-0009/

Published

May 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27304Operation restriction bypass vulnerability in Message and Bu…4.3
• CVE-2023-27305Incorrect default permissions in some Intel(R) Arc(TM) Contr…7.8
• CVE-2023-27306Improper Initialization in firmware for some Intel(R) Optane…5.5
• CVE-2023-27307Improper buffer restrictions in some Intel(R) Thunderbolt(TM…3.8
• CVE-2023-27308Improper buffer restrictions in some Intel(R) Thunderbolt(TM…4.6
• CVE-2023-27309A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
• CVE-2023-27310A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
• CVE-2023-27311NetApp Blue XP Connector versions prior to 3.9.25 expose inf…5.3
• CVE-2023-27312SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4…4.3
• CVE-2023-27313SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible…8.8
• CVE-2023-27314ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.…7.5
• CVE-2023-27315SnapGathers versions prior to 4.9 are susceptible to a vulne…5.5