CVE-2017-9404: In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable...

Security readout for executives and security teams

This CVE is a denial-of-service issue in LibTIFF 4.0.7. A specially crafted TIFF/OJPEG file can trigger a memory leak while the library reads JPEG table metadata, potentially exhausting resources in software that processes untrusted image files. The source bundle does not provide CVSS, confirmed affected package ranges, or active exploitation evidence. Exposure is most likely where applications, services, batch jobs, or desktop tools use LibTIFF to parse TIFF files from users, partners, email, uploads, archives, or automated media pipelines. The bundle does not identify specific downstream products beyond LibTIFF 4.0.7. Handle this as a routine but real availability risk. It is most urgent for systems that automatically process files from untrusted sources. Lack of CVSS and exploit evidence lowers urgency, but vendor advisories indicate the issue was significant enough for distribution security updates. Mitigation focus: Check Ubuntu, Debian, and upstream LibTIFF guidance for corrected packages.; Inventory systems and applications that process untrusted TIFF files.; Prioritize updates for internet-facing upload and media-processing services..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.