PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5321 Libtiff CVE debrief

CVE-2016-5321 is a denial-of-service vulnerability in libtiff affecting version 4.0.6 and earlier. A crafted TIFF image can trigger an invalid read in the DumpModeDecode function, leading to a crash. The issue is rated CVSS 6.5 (medium) and requires user interaction because the target must process the malicious image.

Vendor
Libtiff
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-20
Original CVE updated
2026-05-13
Advisory published
2017-01-20
Advisory updated
2026-05-13

Who should care

Teams that use libtiff to parse TIFF images should pay attention, especially document-processing systems, image conversion services, and any application that accepts untrusted files from users or external sources.

Technical summary

NVD describes the weakness as an invalid read in libtiff's DumpModeDecode path, categorized as CWE-119. The vulnerable range includes libtiff 4.0.6 and earlier. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating network-reachable exposure may exist when applications accept attacker-supplied TIFF content, but successful exploitation depends on user interaction or file processing.

Defensive priority

Medium. The impact is primarily availability-related crash/DoS, but the bug is in a common parsing path for untrusted images and can affect services that process TIFFs automatically or at scale.

Recommended defensive actions

  • Inventory systems and applications that bundle or depend on libtiff.
  • Upgrade to a patched libtiff release as directed by vendor advisories and distribution security notices.
  • Treat TIFF files from untrusted sources as hostile input and process them in isolated, least-privilege environments when possible.
  • Monitor image-processing services for unexpected crashes or repeated failures while handling TIFF content.
  • Use vendor and distribution advisories to verify whether your operating system packages are already fixed.

Evidence notes

The supplied NVD record states that libtiff 4.0.6 and earlier are vulnerable and that the flaw can cause an invalid read and crash via crafted TIFF images. The record also assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and CWE-119. Linked advisories from openSUSE, Debian, and Gentoo indicate coordinated downstream responses.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5321 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5321

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5321 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5321

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.