CVE-2023-52356 is a high severity (7.5) heap buffer overflow in libtiff, reached through the TIFFReadRGBATileExt() API with a crafted TIFF file. It can crash the program that reads it. Red Hat calls the impact minimal. Update libtiff with your vendor package.
What's affected
NVD lists libtiff and Red Hat Enterprise Linux 8 and 9. The record cites Red Hat errata including RHSA-2024:5079, and later ones for other streams. I did not open them, so check the exact fixed package for your release.
The Red Hat page points to upstream libtiff issue 622 and merge request 546 as the tracker and fix. It describes the problem as a segment fault leading to a crash.
Weakness classes: CWE-122 and CWE-787. NVD files it under both.
Severity differs. All three sources, NVD, Red Hat and cve.org, give the same 7.5 base score with an availability only impact. Red Hat's statement still says the flaw lets an attacker potentially crash a program but that the impact is minimal.
How to check if you're exposed
List libtiff on each host and in each image.
dpkg -l | grep -i libtiff
rpm -q libtiff
Check applications that read tiled TIFF files, since the flaw is in the tile reading call. Imaging tools, scanners, GIS software and document pipelines are the usual places. Bundled copies will not show in the package list, so scan application trees and container layers as well.
What to do now
- Update libtiff through your vendor channel and restart anything that has it loaded.
- Confirm the fixed package version against the Red Hat or distribution advisory for your release.
- Rebuild images that bundle libtiff.
- Run TIFF decoding for untrusted files in a separate, restartable process.
Why it matters
A heap based buffer overflow means the library writes past the end of an allocated block. In the advisory text the visible result is a segmentation fault, so the realistic impact is a denial of service in whatever process decodes the file.
Even a crash matters if the decoder runs inside a shared service. One bad upload can stop a queue, tie up a worker pool or force a restart loop. Tiled TIFF reading is less common than the strip based kind, so many programs never reach the affected call, but you only know that by checking which of your tools use it. The record shows no listing in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Does Red Hat treat this as serious?
Its statement calls the impact minimal, even though the base score is 7.5.
How do I find bundled libtiff?
Package lists miss it. Scan the application and container contents, for example with the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
