Every CVE Search/ Get API key

CVE-2026-52492

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip...

7.8 HighFix available

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.19%Unchanged since Aug 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
CVE-2026-52492
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-65145 7.8

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
EUVD-2026-65145
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-c22p-2vpj-rh5j 7.8

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip...

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
GHSA-c22p-2vpj-rh5j
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
NVD 7.8

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
CVE-2026-52492
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVBELL-CVE-2026-52492 7.8

CVE-2026-52492 does not affect BellSoft software

Record
BELL-CVE-2026-52492
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
CVE-2026-52492
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-52492 7.8

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
DEBIAN-CVE-2026-52492
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3654 9.8

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

An issue in libtiff allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c. The vulnerability is classified as CWE-94 (Code Injection), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.(CVE-2026-52490)

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component(CVE-2026-52491)

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image.(CVE-2026-52492)

Record
OESA-2026-3654
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3655 9.8

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

An issue in libtiff allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c. The vulnerability is classified as CWE-94 (Code Injection), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.(CVE-2026-52490)

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component(CVE-2026-52491)

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image.(CVE-2026-52492)

Record
OESA-2026-3655
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53467 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:53467
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-97923 No score

CVE-2026-52492 affecting package libtiff 4.6.0-14

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Record
AZL-97923
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
libtiff
Azure Linux:3
 through 4.6.0-14 None known
tiff
Debian:12
 All versions, plus listed versions
4.5.0-64.5.0-6+deb12u14.5.0-6+deb12u24.5.0-6+deb12u34.5.0-6+deb12u4
Show 18 moreShow less
4.5.1+git230720-14.5.1+git230720-24.5.1+git230720-34.5.1+git230720-44.5.1+git230720-54.5.1-14.5.1~rc3-14.6.0-14.6.0-24.7.0-14.7.0-24.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:13
 All versions, plus listed versions
4.7.0-34.7.0-3+deb13u14.7.0-3+deb13u24.7.0-3+deb13u34.7.0-4
Show 5 moreShow less
4.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:14
 All versions, plus listed versions
4.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
libtiff
openEuler:22.03-LTS-SP4
 before 4.3.0-54.oe2203sp4
4.3.0-54.oe2203sp4
libtiff
openEuler:20.03-LTS-SP4
 before 4.3.0-40.oe2003sp4
4.3.0-40.oe2003sp4
libtiff
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
libtiff-devel
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
libtiff-static
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
libtiff-tools
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-52492 is a high vulnerability (CVSS 7.8) in libtiff, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in libtiff 4.3.0-54.oe2203sp4.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open