CVE-2016-9273: tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a...

Security readout for executives and security teams

CVE-2016-9273 is a denial-of-service flaw in libtiff 4.0.6's tiffsplit utility. A malicious TIFF file can trigger an out-of-bounds read and crash processing. Business impact is most likely disruption to systems that accept or batch-process untrusted TIFF images. Exposure is most likely where libtiff 4.0.6 or vulnerable distribution packages process TIFF files from users, email, archives, scanners, or document workflows. Internet exposure depends on whether TIFF processing is reachable through upload, conversion, or preview services. Handle this as a routine but real availability risk. It is not supported as actively exploited in the provided sources, but exposed document-processing services should be patched promptly because crashes can disrupt customer-facing workflows. Mitigation focus: Check vendor advisories for fixed libtiff packages and apply supported updates.; Prioritize systems that process TIFF files from untrusted or external sources.; Restrict or queue TIFF processing until vulnerable packages are updated..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.