CVE-2023-26966 - Vulnerability Details - OpenCVE

libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Libtiff	Libtiff
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:libtiff:libtiff:4.5.0:-:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
libtiff-0:4.4.0-10.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:6575	2023-11-07T00:00:00Z

References

Link	Providers
https://gitlab.com/libtiff/libtiff/-/issues/530
https://gitlab.com/libtiff/libtiff/-/merge_requests/473
https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html
https://nvd.nist.gov/vuln/detail/CVE-2023-26966
https://www.cve.org/CVERecord?id=CVE-2023-26966

History

Mon, 03 Nov 2025 21:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html

Wed, 27 Nov 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-06-29T00:00:00.000Z

Updated: 2025-11-03T20:35:25.137Z

Reserved: 2023-02-27T00:00:00.000Z

Link: CVE-2023-26966

Vulnrichment

Updated: 2025-11-03T20:35:25.137Z

NVD

Status : Modified

Published: 2023-06-29T20:15:09.873

Modified: 2025-11-03T21:15:56.500

Link: CVE-2023-26966

Redhat

Severity : Moderate

Publid Date: 2023-02-15T00:00:00Z

Links: CVE-2023-26966 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-26966", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-11-03T20:35:25.137Z", "dateReserved": "2023-02-27T00:00:00.000Z", "datePublished": "2023-06-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-08-01T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gitlab.com/libtiff/libtiff/-/issues/530"}, {"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/473"}, {"name": "[debian-lts-announce] 20230731 [SECURITY] [DLA 3513-1] tiff security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/libtiff/libtiff/-/issues/530", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/473", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20230731 [SECURITY] [DLA 3513-1] tiff security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:35:25.137Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-27T15:42:13.107092Z", "id": "CVE-2023-26966", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T15:42:22.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/libtiff/libtiff/-/issues/530", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/473", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html", "name": "[debian-lts-announce] 20230731 [SECURITY] [DLA 3513-1] tiff security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:35:25.137Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26966", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-27T15:42:13.107092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T15:42:18.301Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://gitlab.com/libtiff/libtiff/-/issues/530"}, {"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/473"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html", "name": "[debian-lts-announce] 20230731 [SECURITY] [DLA 3513-1] tiff security update", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-08-01T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26966", "state": "PUBLISHED", "dateUpdated": "2025-11-03T20:35:25.137Z", "dateReserved": "2023-02-27T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-06-29T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected_release": [{"advisory": "RHSA-2023:6575", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "libtiff-0:4.4.0-10.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}], "bugzilla": {"description": "libtiff: Buffer Overflow in uv_encode()", "id": "2218749", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218749"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-120", "details": ["libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.", "A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to an out-of-bounds read in the uv_encode function in libtiff/tif_luv.c, resulting in a denial of service."], "name": "CVE-2023-26966", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "compat-libtiff3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "compat-libtiff3", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2023-02-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-26966\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-26966"], "statement": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nRed Hat follows best practice and federal requirements for least privilege, allowing only specific processes to be run with isolated accounts specific to the team and federal platforms that have limited privileges that are only used for a single task. The environment leverages file integrity checks and malicious code protections, such as IPS/IDS and antimalware solutions, to help detect and prevent malicious code that attempts to exploit buffer overflow vulnerabilities. Robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks.", "threat_severity": "Moderate"}