CVE-2017-14528

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-09-18 · updated 2026-06-17
Weakness: CWE-416

Description

The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.

Affected products

Debian Linux: 9.0
ImageMagick: 7.0.6

References

http://bugzilla.maptools.org/show_bug.cgi?id=2730
http://www.securityfocus.com/bid/100875
https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560
http://bugzilla.maptools.org/show_bug.cgi?id=2730
http://www.securityfocus.com/bid/100875
https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560

Get alerted when CVE-2017-14528 or the next vulnerability affects your stack