CVE-2016-9536: tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_...

Security readout for executives and security teams

CVE-2016-9536 is a memory corruption flaw in libtiff 4.0.6's tiff2pdf tool. A malformed image processed by this utility could write outside a heap buffer. Business urgency depends on whether your systems automatically convert untrusted TIFF content to PDF. Exposure is most likely where servers, desktops, containers, or workflows include vulnerable libtiff/tiff2pdf and process TIFF files from users, partners, email, archives, or automated ingestion pipelines. Treat as a targeted remediation item, not an emergency from the provided evidence. Prioritize faster if TIFF/PDF conversion is exposed to external uploads or automated document processing. Mitigation focus: Apply relevant vendor security updates for libtiff packages.; Check Red Hat and Debian advisories for fixed package guidance.; Review the upstream libtiff commit and vendor notes before backporting..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.