Every CVE Search/ Get API key

CVE-2026-18495

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

6.1 MediumFix available

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.12%Unchanged since Sep 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
CVE-2026-18495
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-76166 6.1

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
EUVD-2026-76166
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6x88-8xw5-p2gw 6.1

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf`...

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
GHSA-6x88-8xw5-p2gw
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 6.1

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
CVE-2026-18495
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVBELL-CVE-2026-18495 6.1
Record
BELL-CVE-2026-18495
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-18495 6.1

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
DEBIAN-CVE-2026-18495
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2026-4063 6.1

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.(CVE-2026-18495)

Record
OESA-2026-4063
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53467 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:53467
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-18495 6.1

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
UBUNTU-CVE-2026-18495
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVAZL-101736 No score

CVE-2026-18495 affecting package libtiff 4.6.0-14

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Record
AZL-101736
Updated
2026-11-02
OSVSUSE-SU-2026:4252-1 No score

Security update for tiff

This update for tiff fixes the following issue:

  • CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough (bsc#1280164).
Record
SUSE-SU-2026:4252-1
Updated
2026-11-02
OSVSUSE-SU-2026:4845-1 No score

Security update for tiff

This update for tiff fixes the following issue:

  • CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough (bsc#1280164).
Record
SUSE-SU-2026:4845-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtiff
Azure Linux:3
 through 4.6.0-14 None known
tiff
Alpaquita:25
 4.7.0-r0 up to 4.7.1-r0
4.7.1-r0
tiff
Alpaquita:stream
 4.4.0-r1 up to 4.7.1-r0
4.7.1-r0
tiff
BellSoft Hardened Containers:25
 4.7.0-r0 up to 4.7.1-r0
4.7.1-r0
tiff
BellSoft Hardened Containers:stream
 4.4.0-r1 up to 4.7.1-r0
4.7.1-r0
tiff
Debian:12
 All versions, plus listed versions
4.5.0-64.5.0-6+deb12u14.5.0-6+deb12u24.5.0-6+deb12u34.5.0-6+deb12u4
Show 18 moreShow less
4.5.1+git230720-14.5.1+git230720-24.5.1+git230720-34.5.1+git230720-44.5.1+git230720-54.5.1-14.5.1~rc3-14.6.0-14.6.0-24.7.0-14.7.0-24.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:13
 All versions, plus listed versions
4.7.0-34.7.0-3+deb13u14.7.0-3+deb13u24.7.0-3+deb13u34.7.0-4
Show 5 moreShow less
4.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:14
 before 4.7.1-1, plus listed versions
4.7.0-34.7.0-44.7.0-5
4.7.1-1
libtiff
openEuler:20.03-LTS-SP4
 before 4.3.0-41.oe2003sp4
4.3.0-41.oe2003sp4
libtiff
openEuler:22.03-LTS-SP4
 before 4.3.0-55.oe2203sp4
4.3.0-55.oe2203sp4
Show 34 moreShow less
Affected packages
PackageAffectedFixed
libtiff
openEuler:24.03-LTS-SP1
 before 4.6.0-13.oe2403sp1
4.6.0-13.oe2403sp1
libtiff
openEuler:24.03-LTS-SP3
 before 4.6.0-13.oe2403sp3
4.6.0-13.oe2403sp3
libtiff
openEuler:24.03-LTS-SP4
 before 4.6.0-13.oe2403sp4
4.6.0-13.oe2403sp4
libtiff
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
libtiff-devel
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
libtiff-static
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
libtiff-tools
Red Hat:hummingbird:1
 before 0:4.7.2-2.hum1
0:4.7.2-2.hum1
tiff
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 4.0.9-44.118.1
4.0.9-44.118.1
tiff
SUSE:Linux Enterprise Micro 5.3
 before 4.0.9-150000.45.72.1
4.0.9-150000.45.72.1
tiff
SUSE:Linux Enterprise Micro 5.4
 before 4.0.9-150000.45.72.1
4.0.9-150000.45.72.1
tiff
SUSE:Linux Enterprise Micro 5.5
 before 4.0.9-150000.45.72.1
4.0.9-150000.45.72.1
tiff
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 4.0.9-150000.45.72.1
4.0.9-150000.45.72.1
gdal
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.9.0-3.1ubuntu41.9.0-3.1ubuntu61.10.1+dfsg-21.10.1+dfsg-2build11.10.1+dfsg-3
Show 8 moreShow less
1.10.1+dfsg-3build11.10.1+dfsg-3build21.10.1+dfsg-3ubuntu11.10.1+dfsg-3ubuntu21.10.1+dfsg-5ubuntu11.10.1+dfsg-5ubuntu1+esm11.10.1+dfsg-5ubuntu1+esm21.10.1+dfsg-5ubuntu1+esm3
 None known
tiff
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7
Show 27 moreShow less
4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.104.0.3-7ubuntu0.114.0.3-7ubuntu0.11+esm14.0.3-7ubuntu0.11+esm24.0.3-7ubuntu0.11+esm34.0.3-7ubuntu0.11+esm44.0.3-7ubuntu0.11+esm54.0.3-7ubuntu0.11+esm64.0.3-7ubuntu0.11+esm74.0.3-7ubuntu0.11+esm84.0.3-7ubuntu0.11+esm94.0.3-7ubuntu0.11+esm104.0.3-7ubuntu0.11+esm114.0.3-7ubuntu0.11+esm124.0.3-7ubuntu0.11+esm134.0.3-7ubuntu0.11+esm144.0.3-7ubuntu0.11+esm154.0.3-7ubuntu0.11+esm164.0.3-7ubuntu0.11+esm17
 None known
tiff
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2
Show 25 moreShow less
4.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.54.0.6-1ubuntu0.64.0.6-1ubuntu0.74.0.6-1ubuntu0.84.0.6-1ubuntu0.8+esm14.0.6-1ubuntu0.8+esm24.0.6-1ubuntu0.8+esm34.0.6-1ubuntu0.8+esm44.0.6-1ubuntu0.8+esm64.0.6-1ubuntu0.8+esm74.0.6-1ubuntu0.8+esm84.0.6-1ubuntu0.8+esm94.0.6-1ubuntu0.8+esm104.0.6-1ubuntu0.8+esm114.0.6-1ubuntu0.8+esm124.0.6-1ubuntu0.8+esm134.0.6-1ubuntu0.8+esm144.0.6-1ubuntu0.8+esm154.0.6-1ubuntu0.8+esm164.0.6-1ubuntu0.8+esm174.0.6-1ubuntu0.8+esm184.0.6-1ubuntu0.8+esm194.0.6-1ubuntu0.8+esm20
 None known
gdal
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.11.2+dfsg-3ubuntu31.11.2+dfsg-3ubuntu41.11.3+dfsg-2build11.11.3+dfsg-2build21.11.3+dfsg-2build3
Show 5 moreShow less
1.11.3+dfsg-31.11.3+dfsg-3build11.11.3+dfsg-3build21.11.3+dfsg-3ubuntu0.1~esm11.11.3+dfsg-3ubuntu0.1~esm2
 None known
tiff
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3
Show 23 moreShow less
4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.14.0.9-5ubuntu0.24.0.9-5ubuntu0.34.0.9-5ubuntu0.44.0.9-5ubuntu0.54.0.9-5ubuntu0.64.0.9-5ubuntu0.74.0.9-5ubuntu0.84.0.9-5ubuntu0.94.0.9-5ubuntu0.104.0.9-5ubuntu0.10+esm14.0.9-5ubuntu0.10+esm24.0.9-5ubuntu0.10+esm34.0.9-5ubuntu0.10+esm44.0.9-5ubuntu0.10+esm54.0.9-5ubuntu0.10+esm64.0.9-5ubuntu0.10+esm74.0.9-5ubuntu0.10+esm84.0.9-5ubuntu0.10+esm94.0.9-5ubuntu0.10+esm10
 None known
neuron
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.5-1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1
 None known
texmaker
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1
 None known
tiff
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.0.10+git191003-14.1.0+git191117-14.1.0+git191117-24.1.0+git191117-2build14.1.0+git191117-2ubuntu0.20.04.1
Show 16 moreShow less
4.1.0+git191117-2ubuntu0.20.04.24.1.0+git191117-2ubuntu0.20.04.34.1.0+git191117-2ubuntu0.20.04.44.1.0+git191117-2ubuntu0.20.04.54.1.0+git191117-2ubuntu0.20.04.64.1.0+git191117-2ubuntu0.20.04.74.1.0+git191117-2ubuntu0.20.04.84.1.0+git191117-2ubuntu0.20.04.94.1.0+git191117-2ubuntu0.20.04.104.1.0+git191117-2ubuntu0.20.04.114.1.0+git191117-2ubuntu0.20.04.124.1.0+git191117-2ubuntu0.20.04.134.1.0+git191117-2ubuntu0.20.04.144.1.0+git191117-2ubuntu0.20.04.14+esm14.1.0+git191117-2ubuntu0.20.04.14+esm24.1.0+git191117-2ubuntu0.20.04.14+esm3
 None known
neuron
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.6.3-1build27.6.3-1build37.6.3-1build4
 None known
qtwebengine-opensource-src
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7
Show 4 moreShow less
5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1
 None known
texmaker
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1
 None known
neuron
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.6.3-1build57.6.3-1build6
 None known
tiff
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.3.0-14.3.0-24.3.0-34.3.0-3build14.3.0-4
Show 15 moreShow less
4.3.0-54.3.0-64.3.0-6ubuntu0.14.3.0-6ubuntu0.24.3.0-6ubuntu0.34.3.0-6ubuntu0.44.3.0-6ubuntu0.54.3.0-6ubuntu0.64.3.0-6ubuntu0.74.3.0-6ubuntu0.84.3.0-6ubuntu0.94.3.0-6ubuntu0.104.3.0-6ubuntu0.114.3.0-6ubuntu0.124.3.0-6ubuntu0.13
 None known
qtwebengine-opensource-src
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1
Show 4 moreShow less
5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1
 None known
tiff
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.5.1+git230720-1ubuntu14.5.1+git230720-3ubuntu14.5.1+git230720-4ubuntu14.5.1+git230720-4ubuntu24.5.1+git230720-4ubuntu2.1
Show 4 moreShow less
4.5.1+git230720-4ubuntu2.24.5.1+git230720-4ubuntu2.34.5.1+git230720-4ubuntu2.44.5.1+git230720-4ubuntu2.5
 None known
qtwebengine-opensource-src
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1
 None known
qtwebengine-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7
 None known
tiff
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.7.0-3ubuntu34.7.0-3ubuntu44.7.0-3ubuntu5
 None known
qtwebengine-opensource-src
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18495 is a medium vulnerability (CVSS 6.1) in Red Hat Ceph Storage 4, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in tiff 4.7.1-r0.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open