peter bassill · operator
$ cve CVE-2006-2656 JSON

CVE-2006-2656 EXPLOIT

7.5
HIGH · CVSS 2.0 · EPSS 14.4% (pctl 97)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.

Scoring

CVSS7.5 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS14.42% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploityes
Published2006-05-30
Last modified2026-09-23

Affected (1)

VendorProduct
libtifflibtiff

Public exploits

SourceTitleDate
exploit-dbtiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow2006-05-26

References

→ the Explorer  ·  watch your stack  ·  NVD