CVE-2015-8668: Libtiff

Critical severity, CVSS 9.8. EPSS: 13.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

Affected products

• Libtiff Libtiff: up to and including 4.0.6
• Oracle Linux: version 6 only; version 7 only
• Oracle Vm Server: version 3.3 only; version 3.4 only
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2016-01-08. Last modified 2026-06-17.