CVE-2016-9539: tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer().

Security readout for executives and security teams

This CVE describes a memory read error in libtiff 4.0.6's tiffcrop utility. A specially formed TIFF file may cause the tool to read outside expected memory while handling tiled image data. The public bundle does not provide CVSS, product packaging details, or confirmed business impact. Exposure is most likely where libtiff 4.0.6 or its tiffcrop utility processes TIFF files, especially files supplied by users, partners, or automated ingestion pipelines. The source bundle does not identify affected operating systems, applications, or packaged distributions. Treat this as a targeted image-processing risk with incomplete severity data. Routine patching is reasonable for general systems, but prioritize any external file upload, document conversion, or automated image-processing pipeline that uses libtiff 4.0.6 or tiffcrop. Mitigation focus: Inventory systems and containers for libtiff 4.0.6 and tiffcrop usage.; Check vendor or distribution advisories for a supported fixed libtiff package.; Review the referenced upstream commit before relying on a source-level patch..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.