CVE-2009-2347: Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4....

Security readout for executives and security teams

CVE-2009-2347 is a libtiff tools flaw where specially crafted TIFF images with very large dimensions can corrupt memory during color conversion. If a vulnerable system processes attacker-supplied TIFF files, the result could be arbitrary code execution in that processing context. Exposure is most likely on systems that run vulnerable libtiff conversion tools against untrusted TIFF files, such as upload pipelines, document processing, image conversion jobs, or desktop workflows. The provided affected-product metadata is incomplete beyond the libtiff version range in the CVE description. Treat as high priority where TIFF files from customers, email, uploads, or partners are processed automatically. Prioritize patching and isolation for conversion services; deprioritize only where vulnerable libtiff tools are absent or restricted to trusted input. Mitigation focus: Inventory libtiff versions and conversion-tool usage across servers, desktops, and containers.; Apply operating-system or vendor libtiff updates referenced by trusted advisories.; Avoid processing untrusted TIFF files with vulnerable tiff2rgba or rgb2ycbcr tools..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.