Vulnerability record · CVE-2006-3459 · published 3 August 2006
CVE-2006-3459: libtiff TIFFFetchShortPair stack buffer overflow via crafted TIFF
Libtiff · Libtiff
libtiff before 3.8.2 contains multiple stack-based buffer overflows, including one reachable through a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c. Because libtiff is embedded in many image-handling products, including Adobe Reader 9.3.0, a malformed TIFF can crash or compromise any application that parses it.
Description
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution with a high EPSS score, though no confirmed in-the-wild exploitation is recorded.
What it is
libtiff before 3.8.2 contains multiple stack-based buffer overflows, including one reachable through a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c. Because libtiff is embedded in many image-handling products, including Adobe Reader 9.3.0, a malformed TIFF can crash or compromise any application that parses it.
Impact
An attacker can execute arbitrary code in the context of the process that parses the TIFF, or cause a denial of service through a crash.
Attack surface
Reached by supplying a crafted TIFF file to a vulnerable libtiff-based parser; the CVSS vector AV:N/AC:L/Au:N indicates network delivery with no authentication, and exploitation typically requires the victim to open or process the file.
Exploitation
Not listed in CISA KEV, but EPSS is 0.5368 (99th percentile), indicating high predicted exploitation activity; references are vendor advisories without exploit tags.
What to do
- Upgrade libtiff to 3.8.2 or later, and apply the corresponding vendor patches for products bundling libtiff such as Adobe Reader.
- Inventory applications and libraries that embed libtiff and confirm their bundled version.
- Block or sandbox untrusted TIFF processing, and disable automatic image preview or thumbnail generation where feasible.
- Apply vendor advisories listed in the references for OS and application packages that ship libtiff.
Detection
- Monitor for crashes or abnormal process termination in applications that parse TIFF files.
- Scan for TIFF files with unusually large tdir_count or malformed directory entries in mail attachments and file uploads.
- Track libtiff versions across endpoints and flag hosts running versions before 3.8.2.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3459 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3459), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
