High 7.5Published Jan 25, 2024

CVE-2023-52356A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API.

Updated under an hour ago (Oct 28, 2026, 5:25 PM ET)

Does this affect you?

It affects debian_linux and 13 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for debian_linux

Exploited in the last 30 days

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-122, CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

debian debian_linux debian:debian_linux	10.0; 11.0	NVD
apple ipados apple:ipados	before 16.7.9; from 17.0 before 17.6	NVD
apple iphone_os apple:iphone_os	before 16.7.9; from 17.0 before 17.6	NVD
apple macos apple:macos	before 12.7.6; from 13.0 before 13.6.8; from 14.0 before 14.6	NVD
apple tvos apple:tvos	before 17.6	NVD
apple visionos apple:visionos	before 1.3	NVD
apple watchos apple:watchos	before 10.6	NVD
libtiff libtiff libtiff:libtiff	before 4.6.0	NVD
redhat ai_inference_server redhat:ai_inference_server	from 3.2.0 before 3.2.2; 3.3.0	NVD
redhat codeready_linux_builder redhat:codeready_linux_builder	8.0; 9.0; 10.0	NVD
1–10 of 14

References

References

https://access.redhat.com/errata/RHSA-2024:5079	vendor-advisory
https://access.redhat.com/errata/RHSA-2025:20801	vendor-advisory
https://access.redhat.com/errata/RHSA-2025:21994	vendor-advisory
https://access.redhat.com/errata/RHSA-2025:23078	vendor-advisory
https://access.redhat.com/errata/RHSA-2025:23079	vendor-advisory
https://access.redhat.com/errata/RHSA-2025:23080	vendor-advisory
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisory
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisory
https://access.redhat.com/errata/RHSA-2026:3461	vendor-advisory
https://access.redhat.com/errata/RHSA-2026:3462	vendor-advisory
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.