PUBLIC MIRROR A read-only public view of Anvil. Only publicly-disclosed findings are shown; the Playbook, techniques, sessions and embargoed research are hidden.

← Targets

📖 libtiff

exhausted v4.7.2 (master d01a94b, 2026-06-27) github.com/libsdl-org/libtiff
5%
Research headroom
34/34
Modules examined
7 · 0 CVEs
Findings

Research map

Every module of the codebase — size and color it by attack surface, findings, or coverage, switch to the list / files view, and click a module to inspect its findings.

Where to look next

The platform ranks the highest-value modules and techniques to try next.

🔒 Next moves — internal

Per-module leads, untried techniques and the recommended sweep are part of the internal platform.

Disclosed findings (7, 0 CVEs)

More vulnerabilities will appear here as they are patched and publicly disclosed.

ID Title Class Severity Evidence Status CVE Discovered
LIBTIFF-0007 Heap OOB (read+write) in TIFFAppendToStrip via out-of-range strip index (TIFFGrowStrips grows by 1) oob-write low ✓ disclosure verified — 2026-07-03
LIBTIFF-0001 tiffcrop 24-bit sample extractor: signed left-shift overflow UB (uint8 << 24) other low ✓ disclosure verified — 2026-07-02
LIBTIFF-0002 Heap OOB write in JPEGDecodeRaw 12-bit downsampled path (unbounded tmpbuf clump write) oob-write high ✓ disclosure verified — 2026-07-02
LIBTIFF-0003 Heap OOB read (+ misaligned load) in JPEGEncodeRaw 12-bit path — packed samples read as 2-byte oob-read medium ✓ disclosure verified — 2026-07-02
LIBTIFF-0004 Heap OOB read in ColorMap/TransferFunction IFD writers when BitsPerSample enlarged after set oob-read low ✓ disclosure verified — 2026-07-02
LIBTIFF-0005 Signed left-shift overflow UB in tiff2ps Ascii85Encode (colormap/pixel emission) other low ✓ disclosure verified — 2026-07-02
LIBTIFF-0006 thumbnail: division-by-zero (SIGFPE) via filterWidth uint16_t truncation dos low ✓ disclosure verified — 2026-07-02
Attack surface & downstream impact

Attack surface

TIFF container / IFD directory parsing (tif_dirread)Strip & tile geometry / size computation (tif_strip, tif_tile, tif_read)RGBA image assembly & color conversion (tif_getimage, tif_color)Codec decoders (LZW, PackBits, Thunder, NeXT, Fax3/4, PixarLog, LogLuv, LZMA/ZIP/ZSTD/WebP, JPEG/OJPEG, LERC, JBIG)Horizontal predictor (tif_predict)Command-line tools (tiffcp, tiffcrop, tiff2pdf, tiff2ps, etc.)

Downstream impact

Image-processing pipelines & OS image loaders (GDAL, ImageMagick, GraphicsMagick, Netpbm)Print/scan stacks, PDF generators (tiff2pdf), remote-sensing/GISLanguage bindings (Pillow via libtiff, Go/Rust wrappers)
Disclosure timeline (7)
FindingReportedVendor ackPublicPatched in
LIBTIFF-0001 2026-07-03 — — —
LIBTIFF-0002 2026-07-03 — 2026-07-04 —
LIBTIFF-0003 2026-07-03 — 2026-07-04 —
LIBTIFF-0004 2026-07-03 — — —
LIBTIFF-0005 2026-07-03 — — —
LIBTIFF-0006 2026-07-03 — — —
LIBTIFF-0007 2026-07-03 — — —