A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade compat-libtiff3Upgrade libtiffUpgrade mingw64-libtiffUpgrade mingw64-libtiff-staticUpgrade libtiff-develUpgrade mingw32-libtiffUpgrade mingw32-libtiff-staticUpgrade libtiff-tools | May 3, 2026 | Apr 30, 2026 |
| Alpine Linux | — | Upgrade qt6-qtwebengine | May 25, 2026 | Mar 24, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libtiff-toolsUpgrade libtiff-staticUpgrade compat-libtiff3Upgrade libtiff-debuginfoUpgrade compat-libtiff3-debuginfoUpgrade libtiff-develUpgrade libtiff | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-debuginfo | Apr 14, 2026 | Mar 24, 2026 |
| Debian | — | Upgrade tiff | Apr 10, 2026 | Apr 10, 2026 |
| Freebsd | — | Upgrade tiff | Apr 14, 2026 | Apr 11, 2026 |
| Oracle_linux | — | Upgrade libtiffUpgrade compat-libtiff3Upgrade mingw64-libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-develUpgrade mingw32-libtiff-staticUpgrade mingw32-libtiffUpgrade mingw64-libtiff | May 4, 2026 | Mar 24, 2026 |
| Redhat_linux | — | Upgrade libtiff-tools-debuginfoUpgrade mingw32-libtiffUpgrade mingw64-libtiff-staticUpgrade compat-libtiff3-debuginfoUpgrade libtiff-debugsourceUpgrade mingw64-libtiff-debuginfoUpgrade libtiff-develNo solution existsUpgrade mingw64-libtiffUpgrade compat-libtiff3Upgrade mingw32-libtiff-staticUpgrade libtiff-debuginfoUpgrade libtiffUpgrade libtiff-toolsUpgrade mingw32-libtiff-debuginfoUpgrade libtiff-staticUpgrade compat-libtiff3-debugsource | May 4, 2026 | Mar 24, 2026 |
| Rocky_linux | — | Upgrade libtiff-debuginfoUpgrade compat-libtiff3Upgrade compat-libtiff3-debuginfoUpgrade libtiffUpgrade compat-libtiff3-debugsourceUpgrade libtiff-develUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsource | May 4, 2026 | May 1, 2026 |
| Suse | — | Upgrade libtiff5Upgrade libtiff-develUpgrade libtiff5-32bitUpgrade tiffUpgrade libtiff6-32bitUpgrade libtiff6 | May 26, 2026 | May 4, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub