CVE-2023-3576

What it actually does

Memory leak in tiffcrop when processing a crafted TIFF image leads to unbounded memory consumption and eventual application crash resulting in denial of service.

Why it matters to the business

Disrupts automated image-processing pipelines and workflows that rely on tiffcrop, causing service outages or delayed operations with potential operational cost from repeated crashes on untrusted input files.

How an attack unfolds

An attacker crafts a specially malformed TIFF image and supplies it to the tiffcrop utility; the utility leaks memory on each processing attempt until the process terminates, denying service to legitimate users.

How to fix it

Upgrade libtiff to the commit 4f34a374b2e2cba3c8055ab77458c5730c073aff or later; rebuild tiffcrop and any dependent applications; replace older binaries in all build and runtime environments.

How to confirm the fix worked

Confirm the installed libtiff version contains commit 4f34a374b2e2cba3c8055ab77458c5730c073aff; re-run tiffcrop against known trigger files and verify absence of memory growth or crashes; perform regression tests on image-processing pipelines.

Typical attack path

1. Create or obtain a malicious TIFF image that triggers the leak path in tiffcrop
2. Deliver the file to a target system or service that invokes tiffcrop on untrusted input
3. Trigger processing of the file via local execution, batch job, or automated workflow
4. Observe repeated crashes or resource exhaustion leading to denial of service

How to detect it

Search application and system logs for repeated tiffcrop crashes or segmentation faults; monitor process memory metrics for steady growth when tiffcrop processes TIFF files; review batch or automation logs that call tiffcrop on external images.

What your security team should do

• Immediately update all instances of libtiff to the fixed commit and rebuild dependent tools
• Inventory systems and containers that invoke tiffcrop on external or untrusted files
• Disable or sandbox tiffcrop usage until patches are applied
• Monitor for tiffcrop process crashes and unusual memory usage in image-processing jobs