CVE-2022-34526

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-29 · updated 2026-06-17
Weakness: CWE-787

Description

A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.

Affected products

Debian Linux: 10.0, 11.0
Fedoraproject Fedora: 36
libtiff: 4.4.0
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp ONTAP Select Deploy administration utility: all versions

References

https://gitlab.com/libtiff/libtiff/-/issues/433
https://gitlab.com/libtiff/libtiff/-/issues/486
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FC6LWPAEKYJ57LSHX4SBFMLRMLOZTHIJ/
https://security.netapp.com/advisory/ntap-20220930-0002/
https://www.debian.org/security/2023/dsa-5333
https://gitlab.com/libtiff/libtiff/-/issues/433
https://gitlab.com/libtiff/libtiff/-/issues/486
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FC6LWPAEKYJ57LSHX4SBFMLRMLOZTHIJ/
https://security.netapp.com/advisory/ntap-20220930-0002/
https://www.debian.org/security/2023/dsa-5333

Get alerted when CVE-2022-34526 or the next vulnerability affects your stack