CVE-2023-2731

2023-05-1700:00:00

CWE-476

redhat

www.cve.org

libtiff

lzwdecode

null pointer

tiff format

denial of service

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.2%

JSON

A NULL pointer dereference flaw was found in Libtiff’s LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libtiff",
    "versions": [
      {
        "version": "Fixed in libtiff v4.5.0",
        "status": "affected"
      }
    ]
  }
]