CVE-2022-4645

A flaw was found in tiffcp, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the tiffcp function in tools/tiffcp.c, resulting in a denial of service and limited information disclosure.

libtiff is a general purpose library to manipulate TIFF images. The library itself is not used directly, it's used via another application linked with the library, which means this issue can only be triggered by an application processing untrusted images. Therefore, if there is no way an attacker can provide a crafted image to an application, it's likely not possible to exploit this CVE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.