Loading story…
Red Hat issued Moderate-severity advisories for CVE-2023-52356, a libtiff flaw in TIFFReadRGBATileExt() that can trigger a segmentation fault and denial of service when a system processes a crafted TIFF file. Fixed packages include libtiff-4.4.0-13.el9_6.3 for supported RHEL 9.6 channels, libtiff-4.4.0-15.el9 for supported RHEL 9 releases, and libtiff-4.6.0-6.el10_0.2 and libtiff-4.6.0-6.el10_1.2 for RHEL 10.0 and 10.1 channels, respectively, across x86_64, aarch64, ppc64le, and s390x.
The remediation also follows earlier RHEL 8 container-image updates for Middleware, CUPS, and Camel K Operator deployments, which incorporated fixes for CVE-2023-52356 alongside libtiff heap-overflow issues CVE-2018-15209, CVE-2023-25433, and CVE-2023-6228. Organizations should apply the relevant RHEL updates and, for affected OpenShift and RHEL 8 container environments, pull revised base images and rebuild dependent images to ensure vulnerable libtiff components are replaced.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity RHSA-2026:7304 for RHEL 10.0 update channels, providing libtiff 4.6.0-6.el10_0.2. The update fixes CVE-2023-52356, which a crafted TIFF file can trigger to cause denial of service.
Red Hat published Moderate-severity RHSA-2026:7081 for RHEL 10 and associated lifecycle channels. The advisory supplied libtiff 4.6.0-6.el10_1.2 to remediate CVE-2023-52356.
Red Hat issued Moderate-severity RHSA-2026:5958 for supported RHEL 9.6 update channels. It provided libtiff 4.4.0-13.el9_6.3 to fix CVE-2023-52356, a TIFFReadRGBATileExt segmentation fault that can cause denial of service.
Red Hat published Moderate-severity advisory RHSA-2025:20801 for RHEL 9, shipping corrected libtiff build 4.4.0-15.el9. The update remediated an out-of-memory issue in TIFFRasterScanlineSize64 (CVE-2023-52355) and the TIFFReadRGBATileExt denial-of-service flaw (CVE-2023-52356).
Red Hat issued RHBA-2024:5569 updating RHEL 8-based Middleware Containers to address libtiff vulnerabilities covered by RHSA-2024:5079, including CVE-2023-52356. Red Hat advised customers to pull the new images, revise Dockerfiles or scripts, and rebuild dependent images.
Red Hat issued RHBA-2024:5462 to update the integration/camel-k-rhel8-operator-bundle image for RHEL 8-based Middleware Containers. The image incorporated fixes referenced in RHBA-2024:5387 for four libtiff vulnerabilities, including CVE-2023-52356.
Red Hat published RHBA-2024:5387 for an updated integration/camel-k-rhel8-operator image used with RHEL 8-based Middleware Containers. The update included fixes for CVE-2018-15209, CVE-2023-25433, CVE-2023-6228, and CVE-2023-52356; affected users were told to upgrade and rebuild dependent images.
Red Hat issued RHBA-2024:5367 updating the RHEL 8 rhel8/cups container image to address security issues referenced in RHSA-2024:5079, including multiple libtiff flaws. Red Hat advised users to upgrade the image and rebuild dependent container images.
Red Hat issued RHBA-2024:5115 to update RHEL 8-based Middleware Containers with backported fixes for libtiff vulnerabilities, including CVE-2018-15209, CVE-2023-25433, CVE-2023-6228, and CVE-2023-52356. Users were advised to upgrade base images, update image references, and rebuild dependent containers.
libtiff closed an issue reporting a TIFFReadRGBATileExt segmentation fault and merged commit 51558511 to add row and column validation for TIFFReadRGBATile and TIFFReadRGBAStrip. The maintainer determined the proof of concept used invalid API parameters and characterized the reported crash, later assigned CVE-2023-52356, as a usage issue rather than a security vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcegitlab.com
Open sourcegitlab.com
Open sourcecatalog.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:5079** for Red Hat Enterprise Linux 8 and RHEL 8.10 Extended Life Cycle, updating `libtiff` to remediate four crafted-TIFF vulnerabilities: `CVE-2018-15209`, `CVE-2023-25433`, `CVE-2023-6228`, and `CVE-2023-52356`. The updated packages are available for x86_64, s390x, ppc64le, and aarch64; related tools packages are provided through CodeReady Linux Builder. The flaws are heap-based buffer overflows in libtiff APIs and utilities, including `tiff2pdf`, `tiffcp`, and `tiffcrop`. Processing a malicious TIFF can crash affected programs and cause denial of service; `CVE-2023-25433` stems from incorrect buffer-size updating after `rotateImage()` in `tiffcrop`. Red Hat assessed the issues primarily as requiring crafted-file processing and rated the advisory Moderate, while support and remediation status varies across RHEL releases and the `compat-libtiff3` package.
Aug 26, 2026
Red Hat released **Important** security updates for `libtiff` to address **CVE-2026-12912**, a heap-based buffer overflow that can be triggered by a crafted PixarLog-compressed TIFF image. The flaw occurs when decoding images with `PIXARLOGDATAFMT_8BITABGR` and a stride of 3: `horizontalAccumulate8abgr` expands 3-byte input triplets into 4-byte output pixels, while `PixarLogDecode` advances the output pointer by only 3 bytes. Because `TIFFScanlineSize` can also return an undersized buffer for this configuration, applications that allocate buffers according to documented guidance may write past the end of the heap buffer by roughly one image-width byte per scan line. The issue affects applications that explicitly select the vulnerable output format and read PixarLog-compressed TIFF files with `SamplesPerPixel=3`, while `TIFFReadRGBAImage` is not directly affected. Red Hat said the bug has been addressed across multiple supported product streams, including **RHEL 9.4**, **RHEL 9.2**, and **RHEL 8.6** support channels, with updated packages such as `libtiff-4.4.0-12.el9_4.6`, `libtiff-4.4.0-8.el9_2.6`, and `libtiff-4.0.9-21.el8_6.3` released for affected architectures and variants including SAP, AUS, EUS, and Extended Life Cycle offerings.
Sep 1, 2026
Red Hat released updated RHEL 8 container images for `gcc-toolset-12-toolchain`, `gcc-toolset-13-toolchain`, and the Camel K RHEL 8 operator, incorporating the kernel security fixes delivered through RHSA-2024:5101. The updates address numerous backported kernel defects across memory management, networking, filesystems, drivers, and architecture-specific code, including `CVE-2024-36886`, a TIPC message-reassembly use-after-free that may enable remote code execution. Organizations using the affected base images should upgrade them and rebuild downstream images; Camel K users on OpenShift 4.11 and 4.12 should also update image references in Dockerfiles and automation. Separate RHEL 9.2 Extended Update Support kernel and real-time kernel updates remediate `CVE-2023-6240` (the Marvin RSA-decryption side channel), TLS flaws `CVE-2024-26582` and `CVE-2024-26584`, and `CVE-2024-26586`, a stack-corruption issue in mlxsw Spectrum ACL TCAM handling. Red Hat also issued fixes across supported RHEL 8 and 9 streams for networking defects including `CVE-2024-38555` in `net/mlx5` command-completion error handling and `CVE-2024-26837` in bridge switchdev multicast-database event replay. Administrators must reboot updated RHEL 9.2 systems for the kernel fixes to take effect.
Aug 26, 2026