CVE-2023-52355 is a high severity (7.5) out of memory flaw in libtiff, triggered by a crafted TIFF file passed to the TIFFRasterScanlineSize64() API. It can cause a denial of service. Red Hat rates it moderate. Install your vendor libtiff update and check which Red Hat advisory covers your release.
What's affected
NVD lists libtiff and, through Red Hat, Red Hat Enterprise Linux 8 and 9. The record includes several Red Hat errata, from RHSA-2025:20801 to RHSA-2026:3461, so there are advisories for more than one release. I did not open the errata, so confirm the fixed package version for your release on the Red Hat page.
The Red Hat page describes a crafted TIFF smaller than 379 KB that makes the library compute an oversized value and run out of memory. Red Hat notes the upstream tracker as libtiff issue 621.
Weakness class: CWE-787.
Severity differs. NVD and Red Hat both score the base vector at 7.5 (high), but Red Hat's statement calls the issue moderate severity, because the input is limited to under 379 KB and the effect is denial of service only. Both are valid: the number measures the worst case, the label reflects Red Hat's judgment of real impact.
How to check if you're exposed
Find libtiff on your hosts and in your images.
dpkg -l | grep -i libtiff
rpm -q libtiff
ldd $(which tiffinfo) | grep tiff
Then look for it where package managers do not. Many applications bundle libtiff, and Python or Java imaging libraries may ship their own copy. You can run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull this component in, directly or through another package.
What to do now
- Apply your distribution libtiff update. On Red Hat Enterprise Linux 8 and 9 use the errata linked from the Red Hat CVE page.
- Restart services that load libtiff, since a running process keeps the old library in memory.
- Find bundled copies in container images and application folders and rebuild them from patched bases.
- Put memory limits on services that decode user supplied images, so one bad file cannot take down the host.
Why it matters
The flaw sits in a helper that works out how large a scanline buffer must be. A crafted file can make that calculation return a too big size, and the program then tries to allocate it. The result is a crash or an out of memory condition, not code execution.
The risk is highest for services that accept TIFF uploads from the public: document converters, image resizers and print or fax gateways. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-52355 critical?
No. NVD scores it 7.5 (high) and Red Hat rates it moderate.
Does it allow code execution?
The advisory text describes denial of service through memory exhaustion. It does not claim code execution.
Sources
Last reviewed: 19 October 2026.
