CVE-2009-5022: Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attack...

Security readout for executives and security teams

CVE-2009-5022 is an old LibTIFF flaw where a specially crafted TIFF image can corrupt heap memory in the OJPEG decoder. If a vulnerable system processes that file, the cited CVE says arbitrary code execution may be possible. Exposure is most likely where servers, desktops, or embedded workflows use LibTIFF before 3.9.5 to process untrusted TIFF images, especially document conversion, imaging, scanning, geospatial, archival, or upload pipelines. Treat this as a high-priority legacy dependency risk where TIFF files cross trust boundaries. The vulnerability is old, but arbitrary code execution in image parsing can still matter if obsolete LibTIFF copies remain embedded. Mitigation focus: Inventory LibTIFF versions in applications, containers, appliances, and OS packages.; Upgrade LibTIFF to 3.9.5 or vendor-fixed packages where applicable.; Restrict processing of untrusted TIFF files until vulnerable components are updated..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.