Memory Exhaustion in TIFF Decoder (libtiff)
CVE-2023-29408 Published on August 2, 2023
Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
Products Associated with CVE-2023-29408
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-29408 are published in these products:
Affected Versions
golang.org/x/image/tiff:- Before 0.10.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.