CVE-2016-9535

CVE-2016-9535 is a critical vulnerability in libtiff versions 4.0.6 and earlier, specifically within the tif_predict.h and tif_predict.c files. This flaw can lead to assertion failures in debug mode or, more critically, heap-buffer-overflows in release mode when processing specially crafted TIFF files with unusual tile sizes, particularly those using YCbCr with subsampling. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk, allowing unauthenticated attackers to achieve full compromise (confidentiality, integrity, and availability) over a network with low attack complexity. While there is no known active exploitation in the wild, nor publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion with 12 mentions and media coverage, indicating awareness and potential for future exploitation.