CVE-2023-52356

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

• CWE-122
• CWE-787

• https://access.redhat.com/errata/RHSA-2024:5079Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:20801Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:21994Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23078Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23079Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23080Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:16174Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25096Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3461Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3462Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:5958Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7081Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7304Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7335Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:8746Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:8747Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:8748Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-52356Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2251344Issue Tracking, Vendor Advisory
• https://gitlab.com/libtiff/libtiff/-/issues/622Exploit, Issue Tracking, Patch
• https://gitlab.com/libtiff/libtiff/-/merge_requests/546Issue Tracking, Patch
• https://seclists.org/fulldisclosure/2024/Jul/16Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/17Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/18Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/19Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/20Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/21Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/22Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2024/Jul/23Mailing List, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2023-52356Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2251344Issue Tracking, Vendor Advisory
• https://gitlab.com/libtiff/libtiff/-/issues/622Exploit, Issue Tracking, Patch
• https://gitlab.com/libtiff/libtiff/-/merge_requests/546Issue Tracking, Patch
• https://lists.debian.org/debian-lts-announce/2024/03/msg00011.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/01/msg00019.htmlMailing List, Third Party Advisory
• https://support.apple.com/kb/HT214116Third Party Advisory
• https://support.apple.com/kb/HT214117Third Party Advisory
• https://support.apple.com/kb/HT214118Third Party Advisory
• https://support.apple.com/kb/HT214119Third Party Advisory
• https://support.apple.com/kb/HT214120Third Party Advisory
• https://support.apple.com/kb/HT214122Third Party Advisory
• https://support.apple.com/kb/HT214123Third Party Advisory
• https://support.apple.com/kb/HT214124Third Party Advisory

Published

Jan 25, 2024

Last Modified

Nov 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52350In ril service, there is a possible out of bounds write due …4.4
• CVE-2023-52351In ril service, there is a possible out of bounds write due …7.8
• CVE-2023-52352In Network Adapter Service, there is a possible missing perm…5.5
• CVE-2023-52353An issue was discovered in Mbed TLS through 3.5.1. In mbedtl…7.5
• CVE-2023-52354chasquid before 1.13 allows SMTP smuggling because LF-termin…7.5
• CVE-2023-52355An out-of-memory flaw was found in libtiff that could be tri…7.5
• CVE-2023-52357Vulnerability of serialization/deserialization mismatch in t…7.5
• CVE-2023-52358Vulnerability of configuration defects in some APIs of the a…6.2
• CVE-2023-52359Vulnerability of permission verification in some APIs in the…7.5
• CVE-2023-5236A flaw was found in Infinispan, which does not detect circul…6.5
• CVE-2023-52360Logic vulnerabilities in the baseband.Successful exploitatio…7.5
• CVE-2023-52361The VerifiedBoot module has a vulnerability that may cause a…7.5