Every CVE Search/ Get API key

CVE-2026-36849

Updated libtiff packages fix a security vulnerability

6.5 MediumFix available

The updated packages fix a security vulnerability: Denial of Service via large SamplesPerPixel tag. (CVE-2026-36849)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

OSV Score usedOESA-2026-2834 6.5

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

'Hi,\n\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\nin libtiff.\n\n== Summary ==\n\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\n\n== Affected Versions ==\n\nlibtiff v4.7.1 and prior\n\n== Patch ==', '== References ==\n\n- CVE: CVE-2026-36849\n- Issue:', 'Regards,\nSatriyo Utomo\n(aleens-lab)'

Record
OESA-2026-2834
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedOESA-2026-2835 6.5

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

'Hi,\n\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\nin libtiff.\n\n== Summary ==\n\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\n\n== Affected Versions ==\n\nlibtiff v4.7.1 and prior\n\n== Patch ==', '== References ==\n\n- CVE: CVE-2026-36849\n- Issue:', 'Regards,\nSatriyo Utomo\n(aleens-lab)'

Record
OESA-2026-2835
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedOESA-2026-2836 6.5

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

'Hi,\n\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\nin libtiff.\n\n== Summary ==\n\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\n\n== Affected Versions ==\n\nlibtiff v4.7.1 and prior\n\n== Patch ==', '== References ==\n\n- CVE: CVE-2026-36849\n- Issue:', 'Regards,\nSatriyo Utomo\n(aleens-lab)'

Record
OESA-2026-2836
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedOESA-2026-2837 6.5

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

'Hi,\n\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\nin libtiff.\n\n== Summary ==\n\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\n\n== Affected Versions ==\n\nlibtiff v4.7.1 and prior\n\n== Patch ==', '== References ==\n\n- CVE: CVE-2026-36849\n- Issue:', 'Regards,\nSatriyo Utomo\n(aleens-lab)'

Record
OESA-2026-2837
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2026-0246 No score

Updated libtiff packages fix a security vulnerability

The updated packages fix a security vulnerability: Denial of Service via large SamplesPerPixel tag. (CVE-2026-36849)

Record
MGASA-2026-0246
Updated
2026-11-02
OSVopenSUSE-SU-2026:11225-1 No score

libtiff-devel-32bit-4.7.2-1.1 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.7.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11225-1
Updated
2026-11-02
Show 12 moreShow less
OSVopenSUSE-SU-2026:21289-1 No score

Security update for tiff

This update for tiff fixes the following issues

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Changes for tiff:

  • Update to 4.7.2:

Software configuration changes:

  • cmake: Fix bundle identifiers to use reverse-DNS format
  • cmake: Fix and improve Apple framework build support
  • cmake: Use TurboJPEG CONFIG by default (issue #767)
  • cmake: changes related to 8-/12-bit modes
  • cmake: Replace CMath::CMath with direct link to avoid export.
  • Support for iOS-derived builds
  • Simplify cmake byte order version check
  • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
  • configure.ac: Require bootstrap with at least Autoconf 2.71.

Bug fixes:

  • Handle negative TIFFReadFile results before state updates (issue #854)
  • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
  • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
  • tif_dirwrite.c: add integer overflow checks to allocation size calculations
  • tif_print.c: add integer overflow checks to allocation size calculations
  • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
  • DumpModeSeek: add bounds check to prevent OOB pointer advance
  • TIFFGrowStrips: fix use-after-free on partial realloc failure.
  • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
  • TIFFRGBAImage: avoid int overflows in put functions (issue #830)
  • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
  • tif_getimage: Widen pointer-offset arithmetic in tif_getimage
  • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
  • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
  • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
  • TIFFLinkDirectory() checks for IFD loops (issue #788)
  • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
  • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
  • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
  • tif_getimage: reject tile widths that would overflow toskew (issue #808)
  • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
  • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
  • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
  • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
  • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
  • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
  • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
  • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
  • JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)
  • JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)
  • tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
  • Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
  • PixarLog: error out on invalid ABGR output buffer sizes.
  • PixarLog: complete ABGR bounds check for multi-row strip decoding.
  • PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and…
Record
openSUSE-SU-2026:21289-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-36849 No score

CVE-2026-36849 in tiff - Patched by Root

Root has patched CVE-2026-36849 in the tiff package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-36849
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-36849 No score

CVE-2026-36849 in tiff - Patched by Root

Root has patched CVE-2026-36849 in the tiff package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-36849
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-36849 No score

CVE-2026-36849 in tiff - Patched by Root

Root has patched CVE-2026-36849 in the tiff package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-36849
Updated
2026-11-02
OSVSUSE-SU-2026:22590-1 No score

Security update for tiff

This update for tiff fixes the following issues

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Changes for tiff:

  • Update to 4.7.2:

Software configuration changes:

  • cmake: Fix bundle identifiers to use reverse-DNS format
  • cmake: Fix and improve Apple framework build support
  • cmake: Use TurboJPEG CONFIG by default (issue #767)
  • cmake: changes related to 8-/12-bit modes
  • cmake: Replace CMath::CMath with direct link to avoid export.
  • Support for iOS-derived builds
  • Simplify cmake byte order version check
  • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
  • configure.ac: Require bootstrap with at least Autoconf 2.71.

Bug fixes:

  • Handle negative TIFFReadFile results before state updates (issue #854)
  • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
  • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
  • tif_dirwrite.c: add integer overflow checks to allocation size calculations
  • tif_print.c: add integer overflow checks to allocation size calculations
  • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
  • DumpModeSeek: add bounds check to prevent OOB pointer advance
  • TIFFGrowStrips: fix use-after-free on partial realloc failure.
  • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
  • TIFFRGBAImage: avoid int overflows in put functions (issue #830)
  • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
  • tif_getimage: Widen pointer-offset arithmetic in tif_getimage
  • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
  • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
  • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
  • TIFFLinkDirectory() checks for IFD loops (issue #788)
  • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
  • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
  • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
  • tif_getimage: reject tile widths that would overflow toskew (issue #808)
  • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
  • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
  • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
  • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
  • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
  • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
  • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
  • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
  • JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)
  • JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)
  • tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
  • Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
  • PixarLog: error out on invalid ABGR output buffer sizes.
  • PixarLog: complete ABGR bounds check for multi-row strip decoding.
  • PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and…
Record
SUSE-SU-2026:22590-1
Updated
2026-11-02
OSVSUSE-SU-2026:22616-1 No score

Security update for tiff

This update for tiff fixes the following issues

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Changes for tiff:

  • Update to 4.7.2:

Software configuration changes:

  • cmake: Fix bundle identifiers to use reverse-DNS format
  • cmake: Fix and improve Apple framework build support
  • cmake: Use TurboJPEG CONFIG by default (issue #767)
  • cmake: changes related to 8-/12-bit modes
  • cmake: Replace CMath::CMath with direct link to avoid export.
  • Support for iOS-derived builds
  • Simplify cmake byte order version check
  • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
  • configure.ac: Require bootstrap with at least Autoconf 2.71.

Bug fixes:

  • Handle negative TIFFReadFile results before state updates (issue #854)
  • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
  • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
  • tif_dirwrite.c: add integer overflow checks to allocation size calculations
  • tif_print.c: add integer overflow checks to allocation size calculations
  • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
  • DumpModeSeek: add bounds check to prevent OOB pointer advance
  • TIFFGrowStrips: fix use-after-free on partial realloc failure.
  • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
  • TIFFRGBAImage: avoid int overflows in put functions (issue #830)
  • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
  • tif_getimage: Widen pointer-offset arithmetic in tif_getimage
  • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
  • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
  • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
  • TIFFLinkDirectory() checks for IFD loops (issue #788)
  • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
  • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
  • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
  • tif_getimage: reject tile widths that would overflow toskew (issue #808)
  • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
  • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
  • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
  • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
  • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
  • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
  • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
  • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
  • JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)
  • JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)
  • tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
  • Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
  • PixarLog: error out on invalid ABGR output buffer sizes.
  • PixarLog: complete ABGR bounds check for multi-row strip decoding.
  • PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and…
Record
SUSE-SU-2026:22616-1
Updated
2026-11-02
OSVSUSE-SU-2026:22796-1 No score

Security update for tiff

This update for tiff fixes the following issues:

Update to version 4.7.2.

Security issues fixed:

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Other updates and bugfixes:

  • Enable Lerc support in openSUSE (bsc#1257123).
  • Version 4.7.2:
    • Software configuration changes:
      • cmake: Fix bundle identifiers to use reverse-DNS format
      • cmake: Fix and improve Apple framework build support
      • cmake: Use TurboJPEG CONFIG by default (issue #767)
      • cmake: changes related to 8-/12-bit modes
      • cmake: Replace CMath::CMath with direct link to avoid export.
      • Support for iOS-derived builds
      • Simplify cmake byte order version check
      • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
      • configure.ac: Require bootstrap with at least Autoconf 2.71.
    • Library changes:
      • New/improved functionalities::
      • Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)
    • Bug fixes:
      • Handle negative TIFFReadFile results before state updates (issue #854)
      • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
      • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
      • tif_dirwrite.c: add integer overflow checks to allocation size calculations
      • tif_print.c: add integer overflow checks to allocation size calculations
      • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
      • DumpModeSeek: add bounds check to prevent OOB pointer advance
      • TIFFGrowStrips: fix use-after-free on partial realloc failure.
      • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
      • TIFFRGBAImage: avoid int overflows in put functions (issue #830)
      • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
      • tif_getimage: Widen pointer-offset arithmetic in tif_getimage
      • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
      • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
      • TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)
      • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
      • TIFFLinkDirectory() checks for IFD loops (issue #788)
      • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
      • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
      • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
      • tif_getimage: reject tile widths that would overflow toskew (issue #808)
      • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
      • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
      • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
      • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
      • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
      • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
      • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
      • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
      • JPEG: fix generation of tiled 12-bit…
Record
SUSE-SU-2026:22796-1
Updated
2026-11-02
OSVSUSE-SU-2026:22886-1 No score

Security update for tiff

This update for tiff fixes the following issues

Update to version 4.7.2.

Security issues fixed:

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Other updates and bugfixes:

  • Enable Lerc support in openSUSE (bsc#1257123).
  • Version 4.7.2:
    • Software configuration changes:
      • cmake: Fix bundle identifiers to use reverse-DNS format
      • cmake: Fix and improve Apple framework build support
      • cmake: Use TurboJPEG CONFIG by default (issue #767)
      • cmake: changes related to 8-/12-bit modes
      • cmake: Replace CMath::CMath with direct link to avoid export.
      • Support for iOS-derived builds
      • Simplify cmake byte order version check
      • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
      • configure.ac: Require bootstrap with at least Autoconf 2.71.
    • Library changes:
      • New/improved functionalities::
      • Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)
    • Bug fixes:
      • Handle negative TIFFReadFile results before state updates (issue #854)
      • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
      • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
      • tif_dirwrite.c: add integer overflow checks to allocation size calculations
      • tif_print.c: add integer overflow checks to allocation size calculations
      • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
      • DumpModeSeek: add bounds check to prevent OOB pointer advance
      • TIFFGrowStrips: fix use-after-free on partial realloc failure.
      • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
      • TIFFRGBAImage: avoid int overflows in put functions (issue #830)
      • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
      • tif_getimage: Widen pointer-offset arithmetic in tif_getimage
      • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
      • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
      • TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)
      • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
      • TIFFLinkDirectory() checks for IFD loops (issue #788)
      • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
      • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
      • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
      • tif_getimage: reject tile widths that would overflow toskew (issue #808)
      • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
      • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
      • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
      • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
      • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
      • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
      • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
      • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
      • JPEG: fix generation of tiled 12-bit…
Record
SUSE-SU-2026:22886-1
Updated
2026-11-02
OSVSUSE-SU-2026:2853-1 No score

Security update for tiff

This update for tiff fixes the following issues:

Update to version 4.7.2.

Security issues fixed:

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Other updates and bugfixes:

  • Version 4.7.2:
    • Software configuration changes:
      • cmake: Fix bundle identifiers to use reverse-DNS format
      • cmake: Fix and improve Apple framework build support
      • cmake: Use TurboJPEG CONFIG by default (issue #767)
      • cmake: changes related to 8-/12-bit modes
      • cmake: Replace CMath::CMath with direct link to avoid export.
      • Support for iOS-derived builds
      • Simplify cmake byte order version check
      • Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
      • configure.ac: Require bootstrap with at least Autoconf 2.71.
    • Library changes:
      • New/improved functionalities::
      • Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)
    • Bug fixes:
      • Handle negative TIFFReadFile results before state updates (issue #854)
      • tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
      • tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
      • tif_dirwrite.c: add integer overflow checks to allocation size calculations
      • tif_print.c: add integer overflow checks to allocation size calculations
      • tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
      • DumpModeSeek: add bounds check to prevent OOB pointer advance
      • TIFFGrowStrips: fix use-after-free on partial realloc failure.
      • Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
      • TIFFRGBAImage: avoid int overflows in put functions (issue #830)
      • tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
      • tif_getimage: Widen pointer-offset arithmetic in tif_getimage
      • putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
      • putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
      • TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)
      • TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
      • TIFFLinkDirectory() checks for IFD loops (issue #788)
      • Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
      • TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
      • TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
      • tif_getimage: reject tile widths that would overflow toskew (issue #808)
      • Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
      • TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
      • _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
      • TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
      • _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
      • Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
      • JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
      • JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
      • JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3…
Record
SUSE-SU-2026:2853-1
Updated
2026-11-02
OSVSUSE-SU-2026:3027-1 No score

Security update for tiff

This update for tiff fixes the following issues

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).
Record
SUSE-SU-2026:3027-1
Updated
2026-11-02
OSVSUSE-SU-2026:3054-1 No score

Security update for tiff

This update for tiff fixes the following issues

  • CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
  • CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).
Record
SUSE-SU-2026:3054-1
Updated
2026-11-02
OSVUBUNTU-CVE-2026-36849 No score

[Denial of Service via large SamplesPerPixel tag]

Record
UBUNTU-CVE-2026-36849
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
tiff
Alpaquita:stream
 4.4.0-r1 up to 4.7.2-r0
4.7.2-r0
tiff
BellSoft Hardened Containers:stream
 4.4.0-r1 up to 4.7.2-r0
4.7.2-r0
tiff
Debian:12
 All versions, plus listed versions
4.5.0-64.5.0-6+deb12u14.5.0-6+deb12u24.5.0-6+deb12u34.5.0-6+deb12u4
Show 18 moreShow less
4.5.1+git230720-14.5.1+git230720-24.5.1+git230720-34.5.1+git230720-44.5.1+git230720-54.5.1-14.5.1~rc3-14.6.0-14.6.0-24.7.0-14.7.0-24.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:13
 All versions, plus listed versions
4.7.0-34.7.0-3+deb13u14.7.0-3+deb13u24.7.0-3+deb13u34.7.0-4
Show 5 moreShow less
4.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:14
 before 4.7.1-3, plus listed versions
4.7.0-34.7.0-44.7.0-54.7.1-14.7.1-2
4.7.1-3
libtiff
Mageia:10
 before 4.7.2-1.mga10
4.7.2-1.mga10
libtiff
openEuler:20.03-LTS-SP4
 before 4.3.0-37.oe2003sp4
4.3.0-37.oe2003sp4
libtiff
openEuler:22.03-LTS-SP4
 before 4.3.0-51.oe2203sp4
4.3.0-51.oe2203sp4
libtiff
openEuler:24.03-LTS-SP1
 before 4.6.0-10.oe2403sp1
4.6.0-10.oe2403sp1
libtiff
openEuler:24.03-LTS-SP3
 before 4.6.0-10.oe2403sp3
4.6.0-10.oe2403sp3
Show 60 moreShow less
Affected packages
PackageAffectedFixed
tiff
Root:Debian:11
 before 4.2.0-1+deb11u8.aikido.17
4.2.0-1+deb11u8.aikido.174.2.0-1+deb11u8.aikido.194.2.0-1+deb11u8.aikido.184.2.0-1+deb11u8.aikido.20
rootio-tiff
Root:Debian:11
 before 4.2.0-1+deb11u8.aikido.17
4.2.0-1+deb11u8.aikido.174.2.0-1+deb11u8.aikido.194.2.0-1+deb11u8.aikido.184.2.0-1+deb11u8.aikido.20
tiff
Root:Debian:12
 before 4.5.0-6+deb12u4.aikido.20
4.5.0-6+deb12u4.aikido.204.5.0-6+deb12u4.aikido.214.5.0-6+deb12u4.aikido.22
rootio-tiff
Root:Debian:12
 before 4.5.0-6+deb12u4.aikido.20
4.5.0-6+deb12u4.aikido.204.5.0-6+deb12u4.aikido.214.5.0-6+deb12u4.aikido.22
tiff
Root:Debian:13
 before 4.7.0-3+deb13u3.aikido.8
4.7.0-3+deb13u3.aikido.84.7.0-3+deb13u3.aikido.94.7.0-3+deb13u3.aikido.10
rootio-tiff
Root:Debian:13
 before 4.7.0-3+deb13u3.aikido.8
4.7.0-3+deb13u3.aikido.84.7.0-3+deb13u3.aikido.94.7.0-3+deb13u3.aikido.10
tiff
SUSE:Linux Micro 6.2
From an advisory covering 3 CVEs
 before 4.7.2-160000.1.1
4.7.2-160000.1.1
tiff
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 4.7.2-160000.1.1
4.7.2-160000.1.1
tiff
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 4.7.2-160000.1.1
4.7.2-160000.1.1
tiff
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 4.7.2-1.1
4.7.2-1.1
tiff
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 4.7.2-slfo.1.1_1.1
4.7.2-slfo.1.1_1.1
tiff
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 4.7.2-150600.3.29.1
4.7.2-150600.3.29.1
tiff
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 3 CVEs
 before 4.7.2-150600.3.29.1
4.7.2-150600.3.29.1
tiff
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 3 CVEs
 before 4.7.2-150600.3.29.1
4.7.2-150600.3.29.1
tiff
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 3 CVEs
 before 4.7.2-150600.3.29.1
4.7.2-150600.3.29.1
tiff
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 2 CVEs
 before 4.0.9-44.115.1
4.0.9-44.115.1
tiff
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 2 CVEs
 before 4.0.9-44.115.1
4.0.9-44.115.1
tiff
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
tiff
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 4.0.9-150000.45.69.1
4.0.9-150000.45.69.1
gdal
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.9.0-3.1ubuntu41.9.0-3.1ubuntu61.10.1+dfsg-21.10.1+dfsg-2build11.10.1+dfsg-3
Show 8 moreShow less
1.10.1+dfsg-3build11.10.1+dfsg-3build21.10.1+dfsg-3ubuntu11.10.1+dfsg-3ubuntu21.10.1+dfsg-5ubuntu11.10.1+dfsg-5ubuntu1+esm11.10.1+dfsg-5ubuntu1+esm21.10.1+dfsg-5ubuntu1+esm3
 None known
tiff
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7
Show 27 moreShow less
4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.104.0.3-7ubuntu0.114.0.3-7ubuntu0.11+esm14.0.3-7ubuntu0.11+esm24.0.3-7ubuntu0.11+esm34.0.3-7ubuntu0.11+esm44.0.3-7ubuntu0.11+esm54.0.3-7ubuntu0.11+esm64.0.3-7ubuntu0.11+esm74.0.3-7ubuntu0.11+esm84.0.3-7ubuntu0.11+esm94.0.3-7ubuntu0.11+esm104.0.3-7ubuntu0.11+esm114.0.3-7ubuntu0.11+esm124.0.3-7ubuntu0.11+esm134.0.3-7ubuntu0.11+esm144.0.3-7ubuntu0.11+esm154.0.3-7ubuntu0.11+esm164.0.3-7ubuntu0.11+esm17
 None known
tiff
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2
Show 25 moreShow less
4.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.54.0.6-1ubuntu0.64.0.6-1ubuntu0.74.0.6-1ubuntu0.84.0.6-1ubuntu0.8+esm14.0.6-1ubuntu0.8+esm24.0.6-1ubuntu0.8+esm34.0.6-1ubuntu0.8+esm44.0.6-1ubuntu0.8+esm64.0.6-1ubuntu0.8+esm74.0.6-1ubuntu0.8+esm84.0.6-1ubuntu0.8+esm94.0.6-1ubuntu0.8+esm104.0.6-1ubuntu0.8+esm114.0.6-1ubuntu0.8+esm124.0.6-1ubuntu0.8+esm134.0.6-1ubuntu0.8+esm144.0.6-1ubuntu0.8+esm154.0.6-1ubuntu0.8+esm164.0.6-1ubuntu0.8+esm174.0.6-1ubuntu0.8+esm184.0.6-1ubuntu0.8+esm194.0.6-1ubuntu0.8+esm20
 None known
gdal
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.11.2+dfsg-3ubuntu31.11.2+dfsg-3ubuntu41.11.3+dfsg-2build11.11.3+dfsg-2build21.11.3+dfsg-2build3
Show 5 moreShow less
1.11.3+dfsg-31.11.3+dfsg-3build11.11.3+dfsg-3build21.11.3+dfsg-3ubuntu0.1~esm11.11.3+dfsg-3ubuntu0.1~esm2
 None known
tiff
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3
Show 23 moreShow less
4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.14.0.9-5ubuntu0.24.0.9-5ubuntu0.34.0.9-5ubuntu0.44.0.9-5ubuntu0.54.0.9-5ubuntu0.64.0.9-5ubuntu0.74.0.9-5ubuntu0.84.0.9-5ubuntu0.94.0.9-5ubuntu0.104.0.9-5ubuntu0.10+esm14.0.9-5ubuntu0.10+esm24.0.9-5ubuntu0.10+esm34.0.9-5ubuntu0.10+esm44.0.9-5ubuntu0.10+esm54.0.9-5ubuntu0.10+esm64.0.9-5ubuntu0.10+esm74.0.9-5ubuntu0.10+esm84.0.9-5ubuntu0.10+esm94.0.9-5ubuntu0.10+esm10
 None known
neuron
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.5-1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1
 None known
texmaker
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1
 None known
tiff
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.0.10+git191003-14.1.0+git191117-14.1.0+git191117-24.1.0+git191117-2build14.1.0+git191117-2ubuntu0.20.04.1
Show 16 moreShow less
4.1.0+git191117-2ubuntu0.20.04.24.1.0+git191117-2ubuntu0.20.04.34.1.0+git191117-2ubuntu0.20.04.44.1.0+git191117-2ubuntu0.20.04.54.1.0+git191117-2ubuntu0.20.04.64.1.0+git191117-2ubuntu0.20.04.74.1.0+git191117-2ubuntu0.20.04.84.1.0+git191117-2ubuntu0.20.04.94.1.0+git191117-2ubuntu0.20.04.104.1.0+git191117-2ubuntu0.20.04.114.1.0+git191117-2ubuntu0.20.04.124.1.0+git191117-2ubuntu0.20.04.134.1.0+git191117-2ubuntu0.20.04.144.1.0+git191117-2ubuntu0.20.04.14+esm14.1.0+git191117-2ubuntu0.20.04.14+esm24.1.0+git191117-2ubuntu0.20.04.14+esm3
 None known
neuron
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.6.3-1build27.6.3-1build37.6.3-1build4
 None known
qtwebengine-opensource-src
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7
Show 4 moreShow less
5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1
 None known
texmaker
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1
 None known
neuron
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.6.3-1build57.6.3-1build6
 None known
tiff
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.3.0-14.3.0-24.3.0-34.3.0-3build14.3.0-4
Show 15 moreShow less
4.3.0-54.3.0-64.3.0-6ubuntu0.14.3.0-6ubuntu0.24.3.0-6ubuntu0.34.3.0-6ubuntu0.44.3.0-6ubuntu0.54.3.0-6ubuntu0.64.3.0-6ubuntu0.74.3.0-6ubuntu0.84.3.0-6ubuntu0.94.3.0-6ubuntu0.104.3.0-6ubuntu0.114.3.0-6ubuntu0.124.3.0-6ubuntu0.13
 None known
qtwebengine-opensource-src
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1
Show 4 moreShow less
5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1
 None known
tiff
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.5.1+git230720-1ubuntu14.5.1+git230720-3ubuntu14.5.1+git230720-4ubuntu14.5.1+git230720-4ubuntu24.5.1+git230720-4ubuntu2.1
Show 4 moreShow less
4.5.1+git230720-4ubuntu2.24.5.1+git230720-4ubuntu2.34.5.1+git230720-4ubuntu2.44.5.1+git230720-4ubuntu2.5
 None known
qtwebengine-opensource-src
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1
 None known
qtwebengine-opensource-src
Ubuntu:25.10
 All versions, plus listed versions
5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1
 None known
texmaker
Ubuntu:25.10
 All versions, plus listed versions
5.1.3+dfsg-35.1.3+dfsg-3build1
 None known
tiff
Ubuntu:25.10
 All versions, plus listed versions
4.5.1+git230720-4ubuntu44.7.0-3ubuntu14.7.0-3ubuntu24.7.0-3ubuntu34.7.0-3ubuntu3.1
 None known
qtwebengine-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7
 None known
tiff
Ubuntu:26.10
 All versions, plus listed versions
4.7.0-3ubuntu44.7.1-2ubuntu1
 None known
tiff
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.7.0-3ubuntu34.7.0-3ubuntu44.7.0-3ubuntu5
 None known
qtwebengine-opensource-src
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1
 None known
tiff
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 4.7.2-1.1
4.7.2-1.1
tiff
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 4.7.2-160000.1.1
4.7.2-160000.1.1
tiff-man
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 4.7.2-160000.1.1
4.7.2-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-36849 is a medium vulnerability (CVSS 6.5) in tiff, published June 17, 2026. No source lists public exploit code. Fixed in tiff 4.7.2-r0.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: the rest of 6 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open