NULL Pointer Dereference in Libtiff's TIFF File Processing

CVE-2023-2731

What is CVE-2023-2731?

A notable NULL pointer dereference flaw exists in the LZWDecode() function of the Libtiff library, specifically in the libtiff/tif_lzw.c file. This vulnerability can be exploited by local attackers who create specially crafted input data that causes the program to dereference a NULL pointer during the decompression of TIFF files. This results in a program crash or potential denial of service, impacting the availability and reliability of applications utilizing this library.

References