VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 21, 2022· Updated May 7, 2025

CVE-2022-3626

CVE-2022-3626

Description

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

45

Patches

Vulnerability mechanics

Root cause

"Missing input validation in tiffcrop allows unsupported option combinations that cause an undersized buffer allocation, leading to a heap-buffer-overflow in _TIFFmemset."

Attack vector

An attacker supplies a crafted TIFF file and invokes `tiffcrop` with a combination of mutually-exclusive options such as `-X 1 -Y 2 -R 180 -H 300 -V 300 -i` [ref_id=1]. The tool does not reject this unsupported option combination, causing `processCropSelections` to compute an undersized buffer in `rotateImage`. A subsequent `_TIFFmemset` write then overflows the heap buffer, leading to a crash or denial-of-service [ref_id=1].

Affected code

The out-of-bounds write occurs in `_TIFFmemset` at `libtiff/tif_unix.c:340`, called from `processCropSelections` in `tools/tiffcrop.c:7612` (line 7619 in the CVE description). The allocation path goes through `rotateImage` at `tools/tiffcrop.c:8621`, which calls `limitMalloc` and `_TIFFmalloc` [ref_id=1].

What the fix does

The patch adds a validation check in `process_command_opts` that rejects any combination of crop options (`-X`, `-Y`, `-Z`, `-z`) together with other `PAGE_MODE_x` options (`-H`, `-V`, `-P`, `-J`, `-K`) [ref_id=2]. It also updates documentation and usage strings with "Note 2" warning that such combinations are unsupported and may cause buffer overflows [ref_id=2]. By exiting early when an illegal combination is detected, the patch prevents the undersized buffer allocation and subsequent heap overflow.

Preconditions

  • inputThe attacker must provide a crafted TIFF file that triggers the vulnerable code path.
  • inputThe user must invoke tiffcrop with an unsupported combination of options (e.g., -X, -Y, -Z, or -z together with -H, -V, -P, -J, or -K).

Reproduction

Build libtiff with AddressSanitizer (`CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --prefix=$PWD/build_asan --disable-shared; make -j; make install`). Then run: `./build_asan/bin/tiffcrop -X 1 -Y 2 -R 180 -H 300 -V 300 -i poc /tmp/foo` where `poc` is the crafted file from the issue tracker [ref_id=1].

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.