CVE-2004-1308

CVE-2004-1308 describes an integer overflow vulnerability in libtiff versions 3.5.7 and 3.7.0, specifically within tif_dirread.c and tif_fax3.c. This flaw allows remote attackers to execute arbitrary code by crafting a malicious TIFF file with a -1 entry count in TIFF_ASCII or TIFF_UNDEFINED directory entries, leading to a heap-based buffer overflow. The vulnerability carries a critical CVSS score of 10.0, indicating a severe risk with a network attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Its high FAUCET Risk Score of 96/100 further emphasizes its potential impact. Despite its age, there is no evidence of active exploitation (KEV: No) and no readily available exploit code in Metasploit, Nuclei, or ExploitDB. However, the vulnerability garners significant community discussion with 11 mentions, suggesting continued awareness and interest.