High
Security advisory
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-35523
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:18 UTC · Revision 1
Source evidence
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
osv:CVE-2020-35523
Complete source record
{
"id": "11219951cd0dc329efb993bd725c5b21a38f4571de85c5e75499753ad78b1ba9",
"url": "https://osv.dev/vulnerability/CVE-2020-35523",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-35523",
"summary": "An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
"evidence": "osv:CVE-2020-35523",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-35523",
"aliases": [
"CVE-2020-35523"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/libtiff/libtiff",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4862b0d7bcc786304ff4e8c31e8d5ccfb868fb99"
},
{
"fixed": "c8d613ef497058fe653c467fc84c70a62a4a71b2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.2.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "c8d613ef497058fe653c467fc84c70a62a4a71b2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v4.1.0",
"v4.0.10",
"v4.0.9",
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.4beta",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v4.0.0beta7",
"v4.0.0alpha6",
"v4.0.0alpha5",
"v4.0.0alpha4",
"v4.0.0alpha",
"v3.8.2",
"v3.8.1",
"v3.8.0",
"v3.7.4",
"v3.7.3",
"v3.7.2",
"v3.7.1",
"v3.7.0",
"v3.7.0beta2",
"v3.7.0beta",
"v3.7.0alpha",
"v3.6.1",
"v3.6.0",
"v3.6.0beta2",
"v3.5.7",
"v3.5.5",
"v3.5.4",
"v3.5.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35523.json",
"vanir_signatures": [
{
"id": "CVE-2020-35523-1b48598a",
"digest": {
"length": 2019,
"function_hash": "36333417815985755933996095690696664901"
},
"source": "https://gitlab.com/libtiff/libtiff@c8d613ef497058fe653c467fc84c70a62a4a71b2",
"target": {
"file": "libtiff/tif_getimage.c",
"function": "gtTileContig"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-35523-24b68653",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32509937146222253745041079187048684040",
"302779390650272650917466304761083692609",
"135516467365233555150983157708273992837",
"238695913166268972067432629455617606371",
"209258097333078657581045383789828138458",
"3928011841085945616818954636431396969",
"91802876121448543017365103912725110307",
"40333051240781296831248805455053040251",
"123278035979770438969003612271166470277",
"210070120875231817274691871511712728198",
"126756939809140681514682558545367377062"
]
},
"source": "https://gitlab.com/libtiff/libtiff@c8d613ef497058fe653c467fc84c70a62a4a71b2",
"target": {
"file": "libtiff/tif_getimage.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:12:05Z"
}
}
],
"modified": "2026-10-24T14:12:05.737638188Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMHBYFMX3D5VGR6Y3RXTTH3Q4NF4E6IG/",
"https://lists.debian.org/debian-lts-announce/2021/06/msg00023.html",
"https://security.gentoo.org/glsa/202104-06",
"https://security.netapp.com/advisory/ntap-20210521-0009/",
"https://www.debian.org/security/2021/dsa-4869",
"https://bugzilla.redhat.com/show_bug.cgi?id=1932040",
"https://gitlab.com/libtiff/libtiff/-/commit/c8d613ef497058fe653c467fc84c70a62a4a71b2",
"https://gitlab.com/libtiff/libtiff/-/merge_requests/160"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*"
],
"vendor_product": "libtiff:libtiff",
"extracted_events": [
{
"range": [
{
"fixed": "4.2.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-35523",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443315,
"published_at": "2021-03-09T20:15:12.963+00:00"
}