CVE-2006-2193: Libtiff

High severity, CVSS 7.5. EPSS: 5.4% chance of exploitation in the next 30 days.

Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.

Affected products

• Libtiff Libtiff: up to and including 3.8.2; version 3.4 only; version 3.5.1 only; version 3.5.2 only; version 3.5.3 only; version 3.5.4 only; …

Published 2006-06-08. Last modified 2026-06-16.