CVE-2016-10266

What it actually does

Crafted TIFF image triggers divide-by-zero in libtiff/tif_read.c during read processing, causing application crash and denial of service.

Why it matters to the business

Applications that process TIFF images may crash unexpectedly when handling malicious files, leading to service disruption or loss of availability until restart.

How an attack unfolds

An attacker creates a specially malformed TIFF file that causes a divide-by-zero error in the TIFF reader library; the file is then supplied to any application using the vulnerable LibTIFF version, resulting in an immediate crash without further code execution.

How to fix it

Upgrade affected LibTIFF packages to versions that contain the fix; for the listed Chainguard images use actions-runner-controller-fips 0.9.3-r1 or later and actions-runner-controller-fips-compat 0.9.3-r1 or later. Rebuild and redeploy any containers that embed the vulnerable library.

How to confirm the fix worked

Confirm the running libtiff version is at or above the fixed release; test by attempting to open a known triggering TIFF and verifying the application no longer crashes.

Typical attack path

1. Generate TIFF image containing values that force division by zero in tif_read.c:351
2. Deliver the image via email, web upload, or file share to a target application
3. Victim application opens or parses the image using the vulnerable library
4. Process crashes, producing denial of service

How to detect it

Review application logs and crash dumps for segmentation faults or arithmetic exceptions occurring immediately after TIFF file access; correlate with inbound untrusted image files.

What your security team should do

• Apply the listed fixed package versions immediately in build pipelines
• Scan container images and dependencies for older LibTIFF versions
• Add TIFF handling to file-type allow-lists or sandbox image processing where feasible