CVE-2023-52355: vLLM OOM DoS — HIGH

CISO Take

A high-severity out-of-memory flaw in libtiff's TIFFRasterScanlineSize64() function lets a remote, unauthenticated attacker crash a process simply by submitting a crafted TIFF file smaller than 379 KB — no privileges or user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). It is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS data is unavailable, so there's no evidence of active exploitation today. However, this library ships inside Red Hat AI Inference Server container images (vLLM CUDA and ROCm variants, model-optimization and discovery-ui images), and libtiff itself has 129 downstream dependents and 85 other CVEs on record — a package with a long history of parser bugs that keeps resurfacing in AI/ML container supply chains. As vLLM increasingly serves multimodal/vision-language models that ingest user-supplied images, any endpoint decoding TIFF input is a plausible DoS vector. Apply the relevant Red Hat errata (RHSA-2025:20801/21994/23078-23080, RHSA-2026:3461/3462/41892) or upgrade to a patched libtiff build, and in the meantime enforce memory/resource limits on inference workers so an OOM crash is contained to a single pod rather than the host.

Sources: NVD access.redhat.com ATLAS

What is the risk?

Network-exploitable, low-complexity, no-auth trigger keeps the CVSS base score high (7.5), but the impact is availability-only (C:N/I:N/A:H) — this is a crash/DoS bug, not data exposure or code execution. No KEV listing, no known exploit code, and no EPSS score suggest exploitation likelihood is currently low, but the trivial trigger condition (a small malformed file) means weaponization requires little skill if an attacker targets an exposed image-ingestion path.

How does the attack unfold?

Delivery

Attacker submits a crafted TIFF file under 379 KB to a public-facing AI inference endpoint that accepts image uploads.

AML.T0034.001

Exploitation

TIFFRasterScanlineSize64() miscalculates the required buffer size while decoding the image, triggering an out-of-memory condition.

AML.T0034.001

Impact

The inference worker or container crashes from OOM, denying service to legitimate users of the AI endpoint.

AML.T0029

Delivery

Attacker submits a crafted TIFF file under 379 KB to a public-facing AI inference endpoint that accepts image uploads.

AML.T0034.001

Exploitation

TIFFRasterScanlineSize64() miscalculates the required buffer size while decoding the image, triggering an out-of-memory condition.

AML.T0034.001

Impact

The inference worker or container crashes from OOM, denying service to legitimate users of the AI endpoint.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
86.6K 129 dependents Pushed yesterday 26% patched ~50d to patch Full package profile →
vLLM	pip	—	No patch
86.6K 129 dependents Pushed yesterday 26% patched ~50d to patch Full package profile →
compat-libtiff3	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
libtiff	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Patch libtiff to a fixed version via the listed Red Hat errata (RHSA-2025:20801, 21994, 23078-23080; RHSA-2026:3461, 3462, 41892) or rebuild/redeploy affected container images once upstream fixes land. Validate and restrict accepted image formats/sizes at the API gateway before they reach the decode path. Run inference workers with hard memory limits (cgroups/Kubernetes resource limits) so an OOM event kills a single worker instead of the host. Add auto-restart with backoff and alert on repeated crash-loop behavior on image-ingestion endpoints as a detection signal.

How is it classified?

DoS Inference AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8.3 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2023-52355?

A high-severity out-of-memory flaw in libtiff's TIFFRasterScanlineSize64() function lets a remote, unauthenticated attacker crash a process simply by submitting a crafted TIFF file smaller than 379 KB — no privileges or user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). It is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS data is unavailable, so there's no evidence of active exploitation today. However, this library ships inside Red Hat AI Inference Server container images (vLLM CUDA and ROCm variants, model-optimization and discovery-ui images), and libtiff itself has 129 downstream dependents and 85 other CVEs on record — a package with a long history of parser bugs that keeps resurfacing in AI/ML container supply chains. As vLLM increasingly serves multimodal/vision-language models that ingest user-supplied images, any endpoint decoding TIFF input is a plausible DoS vector. Apply the relevant Red Hat errata (RHSA-2025:20801/21994/23078-23080, RHSA-2026:3461/3462/41892) or upgrade to a patched libtiff build, and in the meantime enforce memory/resource limits on inference workers so an OOM crash is contained to a single pod rather than the host.

Is CVE-2023-52355 actively exploited?

No confirmed active exploitation of CVE-2023-52355 has been reported, but organizations should still patch proactively.

How to fix CVE-2023-52355?

Patch libtiff to a fixed version via the listed Red Hat errata (RHSA-2025:20801, 21994, 23078-23080; RHSA-2026:3461, 3462, 41892) or rebuild/redeploy affected container images once upstream fixes land. Validate and restrict accepted image formats/sizes at the API gateway before they reach the decode path. Run inference workers with hard memory limits (cgroups/Kubernetes resource limits) so an OOM event kills a single worker instead of the host. Add auto-restart with backoff and alert on repeated crash-loop behavior on image-ingestion endpoints as a detection signal.

What systems are affected by CVE-2023-52355?

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference pipelines, containerized AI inference.

What is the CVSS score for CVE-2023-52355?

CVE-2023-52355 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

model servingmultimodal inference pipelinescontainerized AI inference

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

Compliance Controls Affected

ISO 42001: A.8.3

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

Exploitation Scenario

An attacker submits a small (<379 KB), specially crafted TIFF file to a public-facing multimodal LLM inference endpoint (e.g., a vLLM deployment serving a vision-language model) that decodes uploaded images via libtiff. The malformed file triggers a miscalculation in TIFFRasterScanlineSize64(), causing the process to attempt an oversized memory allocation and crash from out-of-memory, taking down the inference worker or container and denying service to legitimate users — repeatable at will since no authentication or user interaction is needed.

Weaknesses (CWE)

CWE-787 Out-of-bounds Write

CWE-787 — Out-of-bounds Write: The product writes data past the end, or before the beginning, of the intended buffer.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.