PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9448 Libtiff CVE debrief

CVE-2016-9448 is a denial-of-service vulnerability in libtiff’s TIFFFetchNormalTag parsing path. A crafted TIFF can trigger a NULL pointer dereference and crash when the code handles TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII values that access 0-byte arrays. The issue was described as an incomplete fix for CVE-2016-9297, so systems that only partially remediated the earlier bug may still be exposed.

Vendor
Libtiff
Product
CVE-2016-9448
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Teams that process untrusted TIFF files with libtiff, including application owners, distribution maintainers, and vendors shipping libtiff 4.0.6 or affected downstream packages. Services that accept user-uploaded images should treat this as a priority availability issue.

Technical summary

NVD lists CVE-2016-9448 with CVSS v3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CWE-476. The vulnerable behavior is in TIFFFetchNormalTag, where specific tag types (TIFF_SETGET_C16ASCII and TIFF_SETGET_C32_ASCII) can lead to access of 0-byte arrays and a NULL pointer dereference, resulting in a crash rather than code execution. The corpus indicates libtiff 4.0.6 as vulnerable, and NVD also lists an affected openSUSE 13.2 package.

Defensive priority

High

Recommended defensive actions

  • Upgrade libtiff to a version that includes the complete fix for CVE-2016-9448 and the earlier CVE-2016-9297 issue.
  • Rebuild or update any downstream packages and images that bundle libtiff, including distro packages and embedded copies.
  • Prioritize patching systems that parse user-supplied TIFF content, especially upload pipelines and image-processing services.
  • Add crash monitoring and service restart handling for components that depend on libtiff while remediation is underway.
  • Review whether your current libtiff version traces back to a partial fix for CVE-2016-9297 and verify vendor advisories for your distribution.

Evidence notes

All claims are grounded in the supplied NVD record, the CVE description, and the linked advisories. The corpus explicitly states the NULL pointer dereference, the affected tag types, the 0-byte array condition, and the relationship to CVE-2016-9297. The timeline reflects the CVE publication date of 2017-01-27; later record modification on 2026-05-13 is a metadata update, not the vulnerability date.

Official resources

CVE-2016-9448 was published on 2017-01-27. The linked advisory and mailing-list references in the corpus date to late 2016 through early 2017, showing that disclosure and downstream coordination occurred around that period.