CVE-2023-6228 Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c

Low 3.3 Published 18 Dec 2023 Updated 21 Nov 2025

A heap-based buffer overflow in the tiffcp utility allows attackers to cause a denial of service via a crafted TIFF file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-6228?

CVE-2023-6228 is a low-severity memory corruption vulnerability in Libtiff Libtiff, published on 18 Dec 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

Weakness: CWE-787

Which versions are affected by CVE-2023-6228?

It affects 1 product.

Products include Libtiff Libtiff.

How do I fix CVE-2023-6228?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-6228 being exploited?

There is no known exploitation of CVE-2023-6228 in the wild and no public exploit code.

All Libtiff Libtiff vulnerabilities

Sources

Also known as AZL-32176, AZL-34956, BELL-CVE-2023-6228, DEBIAN-CVE-2023-6228, ECHO-b538-3ddd-bcda, GHSA-4v5g-xjvw-59g6 and 5 more.