CVE-2023-25434

A heap-based buffer overflow vulnerability was found in LibTIFF's tiffcrop utility in the extractContigSamplesBytes() function. This flaw allows an attacker to pass a crafted TIFF image file to the tiffcrop utility, which causes an out-of-bounds read access resulting in an application crash, eventually leading to a denial of service.

This vulnerability in tiffcrop is classified as moderate severity rather than important because, while it leads to a denial of service (DoS) via a crash, the impact is not critical in terms of system compromise or data loss. The vulnerability, caused by a heap-based buffer overflow, results in an out-of-bounds read, which disrupts the functionality of the tiffcrop utility but does not allow an attacker to execute arbitrary code or escalate privileges. Additionally, exploitation requires the attacker to provide a specially crafted TIFF file, meaning it is not easily triggered remotely without user interaction. While it poses a disruption to operations, it does not lead to broader system vulnerabilities or compromise, justifying its classification as moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.