CVE-2022-1056 Denial of service in libtiff

Medium 5.5 Published 28 Mar 2022 Updated 2 Aug 2024

Attackers can cause denial of service in applications using libtiff by providing a crafted TIFF file that triggers an out-of-bounds read.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-1056?

CVE-2022-1056 is a medium-severity denial of service vulnerability in Libtiff Libtiff, published on 28 Mar 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.

Weakness: CWE-125

Which versions are affected by CVE-2022-1056?

It affects 2 products.

Products include Libtiff Libtiff, Netapp Active Iq Unified Manager.

How do I fix CVE-2022-1056?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-1056 being exploited?

There is no known exploitation of CVE-2022-1056 in the wild and no public exploit code.

All Libtiff Libtiff vulnerabilities

Sources

Also known as AZL-9187, DEBIAN-CVE-2022-1056, GHSA-2ggh-mqg8-7mvr, JLSEC-2025-269, UBUNTU-CVE-2022-1056.