CVE-2022-1622

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.

Database specific

{
    "cna_assigner":  "GitLab",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1622.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3079627ea0dee150e6a208cec8381de611bb842b"
                },
                {
                    "last_affected":  "3079627ea0dee150e6a208cec8381de611bb842b"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / gitlab.com/libtiff/libtiff

Affected ranges

Type

GIT

Repo

https://gitlab.com/libtiff/libtiff

Events

Introduced

d21dcc67d0d3f4686ee989a085ad2bea9c58259d

Fixed

b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:libtiff:libtiff:4.3.0:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "4.3.0"
        },
        {
            "last_affected":  "4.3.0"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.3.0

v4.*

v4.3.0

v4.3.0rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1622.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "99610717102855534426409033808273071332",
            "length":  1508
        },
        "id":  "CVE-2022-1622-9b318011",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/libtiff/libtiff@b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
        "target":  {
            "file":  "libtiff/tif_lzw.c",
            "function":  "LZWPreDecode"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "297304205499719229723862582735391797184",
                "15433957502830867365031511810630214268",
                "212246105566467323765702300287524938539",
                "57201324518598256529912329638284093607",
                "924326278261024855579029760551291294",
                "198651057446999146972310869395586213217",
                "259002140627107494332398747423618063596",
                "324067406375592853659512906454570304710",
                "248811850483569804806380334611492579744",
                "95910564819394607255018754234021125078",
                "291220921187703762238360898628621394452",
                "3648640367411898551406150155254360071",
                "129680571501969712790997894156773833199",
                "164715822644765660797502729876167356518",
                "252580422337327598812012930021645676916",
                "151754513886909563869075708452516409737"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-1622-d7cd34c9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/libtiff/libtiff@b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
        "target":  {
            "file":  "libtiff/tif_lzw.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "63749783208390883576011996837381271528",
            "length":  5343
        },
        "id":  "CVE-2022-1622-dd5d9e10",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/libtiff/libtiff@b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
        "target":  {
            "file":  "libtiff/tif_lzw.c",
            "function":  "LZWDecode"
        }
    }
]

vanir_signatures_modified

"2026-08-12T12:59:24Z"