libtiff

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. libtiff is named in the Tier 1 scope table in the 'Core infrastructure data parsers' row, where a complicated, high-impact improvement tops out at $15,000 against a $100 floor and memory-safety hardening sits in the highest multiplier band the programme operates. Patches must be one to twelve months old at submission, are capped at three per person per month, and sanctions and territory exclusions apply. CVE history 8 Last 12 months 262 Lifetime Memory safety 60 % Parsing/validation 22 % Denial of service 13 % Info disclosure 4 % Latest advisories Loading the feed Overview libtiff is the TIFF decoder for essentially everything: ImageMagick, libvips, GDAL and therefore the whole geospatial stack, Python's Pillow, scanner and fax software, medical imaging and the print industry. TIFF's role as the standard scanner, fax and document-archive format means libtiff is routinely fed files by untrusted outsiders in exactly the environments least likely to be patched, from multifunction printers to government archive systems. 262 lifetime CVEs, 60% of them memory-safety defects, is what that surface has produced so far. There is no vendor and no bounty: the project pays nothing for a report and this sweep found no private security channel, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The TIFF directory (IFD) parser and tag handling, where malformed, truncated and cyclic IFD chains have produced the same class of bug over and over The codec modules: LZW, PackBits, JPEG-in-TIFF, OJPEG (the notorious one), Deflate, PixarLog, LogLuv and the JBIG paths Integer arithmetic on strip and tile geometry, the sizing done in TIFFReadDirectory , and the samples-per-pixel and bits-per-sample validation that is supposed to bound it TIFFRGBAImage and the colour-conversion paths, which run over data whose dimensions the file itself declared The tiffcp , tiff2pdf , tiffcrop and tiffsplit tools, which carry their own dense CVE history and are shelled out to by scripts everywhere The library's C API boundary, since the consumers that matter, ImageMagick, GDAL, Pillow and libvips, reach the decoder through it rather than through the tools Out of scope One-line patches for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules say will not generally be rewarded Bugs in libjpeg-turbo, zlib or libwebp reached through libtiff, since each has its own scope line and all three are separately Tier 1 Patches the maintainers decline, because the money attaches to a patch that is merged and stays merged rather than to one that is proposed Patches outside the one-to-twelve-month age window the programme applies at submission time Submissions beyond the cap of three per person per month Most-valued findings Heap corruption reachable from a crafted TIFF through the IFD parser or a codec module, which is 60% of this project's CVE history and the class the Tier 1 memory-safety multiplier exists to buy out Integer overflow on strip or tile geometry that produces an undersized allocation the decoder then writes past, the single most repeated shape in the libtiff record A bug in the OJPEG or JPEG-in-TIFF paths, the most intricate decoders in the tree and the ones least likely to be exercised by ordinary files Anything reachable through TIFFRGBAImage or the C API, since that is how ImageMagick, GDAL, Pillow and libvips actually call in and where a single defect fans out across the whole imaging ecosystem Memory corruption in tiffcp , tiff2pdf or tiffcrop triggered by an input file, because those binaries are invoked from scripts on files nobody inspected first Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report with the TIFF that triggers it; if it cannot be reproduced it is not eligible libtiff has no vendor and no private security address that this sweep could evidence, and is maintained in the open on GitLab, so agree the disclosure path with the maintainers before anything is filed publicly Bugs that actually live in libjpeg-turbo, zlib or libwebp reached through libtiff belong to those projects, each of which is separately Tier 1 with its own scope line If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway with its own rules On that pathway libtiff is Tier 1 in the 'Core infrastructure data parsers' row, patches must be one to twelve months old, submissions are capped at three per person per month, and one-liners for non-exploitable crashes or resource exhaustion are not rewarded Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the libtiff maintainers on GitLab, where the project is developed in the open rather than behind a private security address. Timing discipline is therefore on you: agree an embargo before filing anything public, and expect a long tail, because the fix has to propagate from libtiff into ImageMagick, GDAL and Pillow, and then into scanner, archive and appliance firmware that may never see it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability