Reference page — cumulative record through Monday, October 5, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-52355

CVE-2023-52355HIGH

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0183   78.1     —

AFFECTED
  Product                                                Versions     Fixed
  libtiff                                                unspecified  —
  Red Hat Enterprise Linux 10                            unspecified  0:4.6.0-8.el10_2.4
  Red Hat Enterprise Linux 10.0 Extended Update Support  unspecified  0:4.6.0-6.el10_0.4
  Red Hat Enterprise Linux 9                             unspecified  0:4.4.0-15.el9
  Red Hat Enterprise Linux 9.6 Extended Update Support   unspecified  0:4.4.0-13.el9_6.5
  Red Hat AI Inference Server 3.2                        unspecified  3.2.2-1765379088
  Red Hat AI Inference Server 3.2                        unspecified  3.2.2-1765379049
  Red Hat AI Inference Server 3.2                        unspecified  3.2.2-1764871796
  Red Hat AI Inference Server 3.2                        unspecified  1772160593
  Red Hat AI Inference Server 3.2                        unspecified  1772160625
  + 18 more

TIMELINE
  Jan 24  Reserved by redhat
  Jan 25  Published (CNA: redhat)
  Aug 3   EXPLOIT PUBLISHED — CVE-2023-52355 (libtiff). Public exploit reference added.
  Sep 30  EXPLOIT PUBLISHED — CVE-2023-52355 (libtiff). Public exploit reference added.
  Oct 2   EXPLOIT PUBLISHED — CVE-2023-52355 (libtiff). Public exploit reference added.

CWE-787 · CNA: redhat · CVSS v3.1 · 25 references · NVD status: Modified

Description

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
January 24, 2024	Reserved	Reserved by redhat
January 25, 2024	Published	Published (CNA: redhat)
August 3, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-52355 (libtiff). Public exploit reference added.
September 30, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-52355 (libtiff). Public exploit reference added.
October 2, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-52355 (libtiff). Public exploit reference added.

Affected

Affected products and packages — 28 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
—	libtiff	—	—	—
Red Hat	Red Hat Enterprise Linux 10	—	—	0:4.6.0-8.el10_2.4
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	—	—	0:4.6.0-6.el10_0.4
Red Hat	Red Hat Enterprise Linux 9	—	—	0:4.4.0-15.el9
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	—	—	0:4.4.0-13.el9_6.5
Red Hat	Red Hat AI Inference Server 3.2	—	—	3.2.2-1765379088
Red Hat	Red Hat AI Inference Server 3.2	—	—	3.2.2-1765379049
Red Hat	Red Hat AI Inference Server 3.2	—	—	3.2.2-1764871796
Red Hat	Red Hat AI Inference Server 3.2	—	—	1772160593
Red Hat	Red Hat AI Inference Server 3.2	—	—	1772160625
Red Hat	Red Hat Discovery 2	—	—	2.4.0-1763656152
Red Hat	Red Hat OpenShift AI 3.0	—	—	1790276886
Red Hat	Red Hat OpenShift AI 3.0	—	—	1790276884
Red Hat	Red Hat OpenShift AI 3.0	—	—	1790277045
Red Hat	Red Hat OpenShift AI 3.0	—	—	1790276889
Red Hat	Red Hat OpenShift AI 3.0	—	—	1790276974
Red Hat	Red Hat OpenShift AI 3.2	—	—	1790703497
Red Hat	Red Hat OpenShift AI 3.2	—	—	1790703506
Red Hat	Red Hat OpenShift AI 3.2	—	—	1790703590
Red Hat	Red Hat OpenShift AI 3.2	—	—	1790703568
Red Hat	Red Hat OpenShift AI 3.2	—	—	1790703586
Red Hat	Red Hat OpenShift AI 3.2	—	—	1790703494
Red Hat	Red Hat OpenShift AI 3.4	—	—	1790703542
Red Hat	Red Hat Enterprise Linux 6	—	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—	—

Weaknesses

CWE-787

References (25)

Authoritative record: CVE-2023-52355 at cve.org

Vendors: red hat

Weaknesses: CWE-787

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-52355 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 5, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.