VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 29, 2022· Updated Aug 3, 2024

CVE-2022-34526

CVE-2022-34526

Description

A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

41

Patches

Vulnerability mechanics

Root cause

"Missing bounds checking in `_TIFFVGetField` allows writing past the end of a stack buffer when processing crafted TIFF tags."

Attack vector

An attacker provides a crafted TIFF file containing malformed or unexpected tags. When `tiffsplit` (or `tiffcrop`) parses this file, the `_TIFFVGetField` function writes beyond the bounds of a stack buffer, causing a stack-buffer-overflow (or global-buffer-overflow in the `tiffcrop` variant) [ref_id=1][ref_id=2]. The attack requires no authentication and is triggered simply by running the utility on the malicious file [ref_id=1].

Affected code

The stack overflow occurs in the `_TIFFVGetField` function within `libtiff/tif_dir.c` at line 1164 [ref_id=1]. The crash is triggered from `tiffsplit.c` line 260 (via `tiffcp`) and also from `tiffcrop` when processing a crafted TIFF file [ref_id=1][ref_id=2]. The second report notes a global-buffer-overflow variant in the same function when reached through `tiffcrop` [ref_id=2].

What the fix does

The advisory for ref_id=2 states that the issue was already patched in merge request !363, but notes that the `tiffcrop` attack vector was not mentioned in the original CVE-2022-34526 description [ref_id=2]. No patch diff is included in the bundle, so the exact code change cannot be described. The remediation guidance is to apply the existing patch from !363, which addresses the buffer overflow in `_TIFFVGetField` for both `tiffsplit` and `tiffcrop` [ref_id=2].

Preconditions

  • inputAttacker must supply a crafted TIFF file that triggers the overflow.
  • configThe victim must run either the tiffsplit or tiffcrop utility on the malicious file.

Reproduction

1. Download the PoC file from the linked repository (ref_id=1) or the poc.zip attached to ref_id=2. 2. Run `tiffsplit $POC` (ref_id=1) or `./tiffcrop -i poc.tif a.tif` (ref_id=2) on a vulnerable build of libtiff v4.4.0.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.