{"id":"CVE-2016-9535","state":"PUBLISHED","title":"tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual t","description":"tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka \"Predictor heap-buffer-overflow.\"","publishedAt":"2016-11-22T19:00:00.000Z","updatedAt":"2026-05-29T20:24:54.106Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://www.debian.org/security/2017/dsa-3844","https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1","https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33","http://rhn.redhat.com/errata/RHSA-2017-0225.html","http://www.securityfocus.com/bid/94744","http://www.securityfocus.com/bid/94484"],"weaknesses":["CWE-119"],"ingestedAt":"2026-10-29T19:42:58.401Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/9xxx/CVE-2016-9535.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2016-9535","state":"PUBLISHED","datePublished":"2016-11-22T19:00:00.000Z","dateUpdated":"2026-05-29T20:24:54.106Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2016-11-21T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka \"Predictor heap-buffer-overflow.\""}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://www.debian.org/security/2017/dsa-3844","name":"DSA-3844","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0225.html","name":"RHSA-2017:0225","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/94744","name":"94744","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securityfocus.com/bid/94484","name":"94484","tags":["vdb-entry","x_refsource_BID"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mitre","dateUpdated":"2018-01-04T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca"},"datePublic":"2016-11-22T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-9535","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka \"Predictor heap-buffer-overflow.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"DSA-3844","refsource":"DEBIAN","url":"http://www.debian.org/security/2017/dsa-3844"},{"name":"https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1","refsource":"CONFIRM","url":"https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1"},{"name":"https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33","refsource":"CONFIRM","url":"https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33"},{"name":"RHSA-2017:0225","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0225.html"},{"name":"94744","refsource":"BID","url":"http://www.securityfocus.com/bid/94744"},{"name":"94484","refsource":"BID","url":"http://www.securityfocus.com/bid/94484"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.debian.org/security/2017/dsa-3844","name":"DSA-3844","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0225.html","name":"RHSA-2017:0225","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securityfocus.com/bid/94744","name":"94744","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/bid/94484","name":"94484","tags":["vdb-entry","x_refsource_BID","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T02:50:38.565Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-05-29T20:24:50.368394Z","id":"CVE-2016-9535","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-29T20:24:54.106Z"}}]}}}