CVE-2016-9534

Critical

Published: 22/11/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The libtiff library version 4.0.6 has an issue in the error code path of the TIFFFlushData1() function that does not reset the tif_rawcc and tif_rawcp members. This leads to a heap buffer overflow.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized memory access, potentially resulting in data leakage or remote code execution.

Recommendation

It is recommended to update the libtiff library to the latest version to mitigate this vulnerability.

Original NVD description (English source)

tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."