TI-2022-03639 Aliases CVE-2022-3970 GHSA-44v9-23w3-fv66

LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow

HIGH 71CWE-189Published 2022-11-13 · Updated 2025-04-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01338 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
unspecified	LibTIFF	all versions	—	No fix listed	CNA

LibTIFF Vendorunspecified Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:libtiff:libtiff::::::::	before 4.5.0	Vulnerable	libtiff
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:a:apple:safari::::::::	before 16.5.1	Vulnerable	Apple
cpe:2.3:o:apple:ipados::::::::	before 16.6	Vulnerable	Apple
cpe:2.3:o:apple:iphone_os::::::::	before 16.6	Vulnerable	Apple
cpe:2.3:o:apple:macos::::::::	before 13.5	Vulnerable	Apple

cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* Versions before 4.5.0 Vulnerable ·libtiff
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 16.5.1 Vulnerable ·Apple
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 16.6 Vulnerable ·Apple
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 16.6 Vulnerable ·Apple
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 13.5 Vulnerable ·Apple

Remediation

Red Hat 2 advisories

RHSA-2023:2883 Released 2023-05-16 · Red Hat rating Moderate
libtiff security update
- Red Hat Enterprise Linux AppStream (v. 8) libtiff-4.0.9-27.el8, libtiff-devel-4.0.9-27.el8
- Red Hat Enterprise Linux CRB (v. 8) libtiff-tools-4.0.9-27.el8
RHSA-2023:2340 Released 2023-05-09 · Red Hat rating Moderate
libtiff security update
- Red Hat Enterprise Linux AppStream (v. 9) libtiff-4.4.0-7.el9, libtiff-devel-4.4.0-7.el9
- Red Hat Enterprise Linux CRB (v. 9) libtiff-tools-4.4.0-7.el9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2023:2883
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2023:2340
Red Hat Enterprise Linux CRB (v. 8)	Fixed	RHSA-2023:2883
Red Hat Enterprise Linux CRB (v. 9)	Fixed	RHSA-2023:2340

Timeline

2026-10-02 Threatist record created from CVE-2022-3970
2026-10-03 Alias added: GHSA-44v9-23w3-fv66

References

Exploit 1

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137

Patch 1

https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be

Advisory 4

Other 1

https://oss-fuzz.com/download?testcase_id=5738253143900160

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences