CVE-2022-2868

libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits()

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · December 8, 2021

Updated · November 22, 2025

Description

An improper input validation flaw was found in libtiff's tiffcrop utility. This issue can lead to an out-of-bounds read and cause a crash if an attacker can supply a crafted file to tiffcrop.

Statement

This flaw is present in the tiffcrop tool only and not in the libtiff library code.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-1284 · Improper Validation of Specified Quantity in Input