CVE-2019-17546: Libtiff

High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days.

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.

Affected products

• Libtiff Libtiff: before 4.1.0 (fixed in 4.1.0)
• OSGeo Gdal: up to and including 3.0.1

Published 2019-10-14. Last modified 2026-06-17.