{"id":"CVE-2026-18495","aliases":["AZL-101736","BELL-CVE-2026-18495","DEBIAN-CVE-2026-18495","EUVD-2026-76166","GHSA-6x88-8xw5-p2gw","OESA-2026-4063","RHSA-2026:53467","SUSE-SU-2026:4252-1","SUSE-SU-2026:4845-1","UBUNTU-CVE-2026-18495"],"status":"published","title":"Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00117,"percentile":0.01673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-08-27T10:14:37Z","modified":"2026-11-09T12:49:53Z","fixes":[{"ecosystem":"Alpaquita:25","package":"tiff","fixed_in":["4.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"tiff","fixed_in":["4.7.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"tiff","fixed_in":["4.7.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"tiff","fixed_in":["4.7.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.7.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libtiff","fixed_in":["4.3.0-41.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libtiff","fixed_in":["4.3.0-55.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libtiff","fixed_in":["4.6.0-13.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libtiff","fixed_in":["4.6.0-13.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libtiff","fixed_in":["4.6.0-13.oe2403sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tiff","fixed_in":["4.0.9-44.118.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tiff","fixed_in":["4.0.9-150000.45.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tiff","fixed_in":["4.0.9-150000.45.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tiff","fixed_in":["4.0.9-150000.45.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tiff","fixed_in":["4.0.9-150000.45.72.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.6.0-14"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0-r0"},{"fixed":"4.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-r1"},{"fixed":"4.7.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0-r0"},{"fixed":"4.7.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-r1"},{"fixed":"4.7.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.0-6","4.5.0-6+deb12u1","4.5.0-6+deb12u2","4.5.0-6+deb12u3","4.5.0-6+deb12u4","4.5.1+git230720-1","4.5.1+git230720-2","4.5.1+git230720-3","4.5.1+git230720-4","4.5.1+git230720-5","4.5.1-1","4.5.1~rc3-1","4.6.0-1","4.6.0-2","4.7.0-1","4.7.0-2","4.7.0-3","4.7.0-4","4.7.0-5","4.7.1-1","4.7.1-2","4.7.1-3","4.7.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-3","4.7.0-3+deb13u1","4.7.0-3+deb13u2","4.7.0-3+deb13u3","4.7.0-4","4.7.0-5","4.7.1-1","4.7.1-2","4.7.1-3","4.7.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-1"}]}],"versions":["4.7.0-3","4.7.0-4","4.7.0-5"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-41.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-55.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-13.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-13.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-13.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.2-2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.2-2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.2-2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.2-2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.118.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.72.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-3.1ubuntu4","1.9.0-3.1ubuntu6","1.10.1+dfsg-2","1.10.1+dfsg-2build1","1.10.1+dfsg-3","1.10.1+dfsg-3build1","1.10.1+dfsg-3build2","1.10.1+dfsg-3ubuntu1","1.10.1+dfsg-3ubuntu2","1.10.1+dfsg-5ubuntu1","1.10.1+dfsg-5ubuntu1+esm1","1.10.1+dfsg-5ubuntu1+esm2","1.10.1+dfsg-5ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5","4.0.3-7ubuntu0.11+esm6","4.0.3-7ubuntu0.11+esm7","4.0.3-7ubuntu0.11+esm8","4.0.3-7ubuntu0.11+esm9","4.0.3-7ubuntu0.11+esm10","4.0.3-7ubuntu0.11+esm11","4.0.3-7ubuntu0.11+esm12","4.0.3-7ubuntu0.11+esm13","4.0.3-7ubuntu0.11+esm14","4.0.3-7ubuntu0.11+esm15","4.0.3-7ubuntu0.11+esm16","4.0.3-7ubuntu0.11+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6","4.0.6-1ubuntu0.7","4.0.6-1ubuntu0.8","4.0.6-1ubuntu0.8+esm1","4.0.6-1ubuntu0.8+esm2","4.0.6-1ubuntu0.8+esm3","4.0.6-1ubuntu0.8+esm4","4.0.6-1ubuntu0.8+esm6","4.0.6-1ubuntu0.8+esm7","4.0.6-1ubuntu0.8+esm8","4.0.6-1ubuntu0.8+esm9","4.0.6-1ubuntu0.8+esm10","4.0.6-1ubuntu0.8+esm11","4.0.6-1ubuntu0.8+esm12","4.0.6-1ubuntu0.8+esm13","4.0.6-1ubuntu0.8+esm14","4.0.6-1ubuntu0.8+esm15","4.0.6-1ubuntu0.8+esm16","4.0.6-1ubuntu0.8+esm17","4.0.6-1ubuntu0.8+esm18","4.0.6-1ubuntu0.8+esm19","4.0.6-1ubuntu0.8+esm20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.2+dfsg-3ubuntu3","1.11.2+dfsg-3ubuntu4","1.11.3+dfsg-2build1","1.11.3+dfsg-2build2","1.11.3+dfsg-2build3","1.11.3+dfsg-3","1.11.3+dfsg-3build1","1.11.3+dfsg-3build2","1.11.3+dfsg-3ubuntu0.1~esm1","1.11.3+dfsg-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2","4.0.9-5ubuntu0.3","4.0.9-5ubuntu0.4","4.0.9-5ubuntu0.5","4.0.9-5ubuntu0.6","4.0.9-5ubuntu0.7","4.0.9-5ubuntu0.8","4.0.9-5ubuntu0.9","4.0.9-5ubuntu0.10","4.0.9-5ubuntu0.10+esm1","4.0.9-5ubuntu0.10+esm2","4.0.9-5ubuntu0.10+esm3","4.0.9-5ubuntu0.10+esm4","4.0.9-5ubuntu0.10+esm5","4.0.9-5ubuntu0.10+esm6","4.0.9-5ubuntu0.10+esm7","4.0.9-5ubuntu0.10+esm8","4.0.9-5ubuntu0.10+esm9","4.0.9-5ubuntu0.10+esm10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"neuron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5-1","5.0.2-1","5.0.2-1build1","5.0.2-1build2","5.0.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.10+git191003-1","4.1.0+git191117-1","4.1.0+git191117-2","4.1.0+git191117-2build1","4.1.0+git191117-2ubuntu0.20.04.1","4.1.0+git191117-2ubuntu0.20.04.2","4.1.0+git191117-2ubuntu0.20.04.3","4.1.0+git191117-2ubuntu0.20.04.4","4.1.0+git191117-2ubuntu0.20.04.5","4.1.0+git191117-2ubuntu0.20.04.6","4.1.0+git191117-2ubuntu0.20.04.7","4.1.0+git191117-2ubuntu0.20.04.8","4.1.0+git191117-2ubuntu0.20.04.9","4.1.0+git191117-2ubuntu0.20.04.10","4.1.0+git191117-2ubuntu0.20.04.11","4.1.0+git191117-2ubuntu0.20.04.12","4.1.0+git191117-2ubuntu0.20.04.13","4.1.0+git191117-2ubuntu0.20.04.14","4.1.0+git191117-2ubuntu0.20.04.14+esm1","4.1.0+git191117-2ubuntu0.20.04.14+esm2","4.1.0+git191117-2ubuntu0.20.04.14+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"neuron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1build2","7.6.3-1build3","7.6.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build2","5.0.3-1build3","5.0.3-1build4","5.0.3-1build5","5.0.3-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0-1","4.3.0-2","4.3.0-3","4.3.0-3build1","4.3.0-4","4.3.0-5","4.3.0-6","4.3.0-6ubuntu0.1","4.3.0-6ubuntu0.2","4.3.0-6ubuntu0.3","4.3.0-6ubuntu0.4","4.3.0-6ubuntu0.5","4.3.0-6ubuntu0.6","4.3.0-6ubuntu0.7","4.3.0-6ubuntu0.8","4.3.0-6ubuntu0.9","4.3.0-6ubuntu0.10","4.3.0-6ubuntu0.11","4.3.0-6ubuntu0.12","4.3.0-6ubuntu0.13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build8","5.0.3-1build9","5.0.3-1ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1+git230720-1ubuntu1","4.5.1+git230720-3ubuntu1","4.5.1+git230720-4ubuntu1","4.5.1+git230720-4ubuntu2","4.5.1+git230720-4ubuntu2.1","4.5.1+git230720-4ubuntu2.2","4.5.1+git230720-4ubuntu2.3","4.5.1+git230720-4ubuntu2.4","4.5.1+git230720-4ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-1build4","5.1.3+dfsg-1build5","5.1.3+dfsg-1build6","5.1.3+dfsg-1build7","5.1.3+dfsg-1build8","5.1.3+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-3ubuntu3","4.7.0-3ubuntu4","4.7.0-3ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]}],"products":[{"vendor":"red hat","product":"red hat ceph storage 4"},{"vendor":"red hat","product":"red hat ceph storage 6"},{"vendor":"red hat","product":"red hat ceph storage 7"},{"vendor":"red hat","product":"red hat ceph storage 8"},{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:53467","tags":["vendor-advisory","x_refsource_REDHAT","advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18495","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531414","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.com/libtiff/libtiff/-/merge_requests/729","tags":["article","report"]},{"url":"https://gitlab.com/libtiff/libtiff/-/tree/67fd283d276f09db54dc39b9ef7b979d4b45c4b1","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18495","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6x88-8xw5-p2gw"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-18495","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18495","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4063","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52492","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52490","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52491","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53467.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18495","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52490","tags":["advisory"]},{"url":"https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3be8671","tags":["article"]},{"url":"https://gitlab.com/libtiff/libtiff/-/work_items/846","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52491","tags":["advisory"]},{"url":"https://gist.github.com/okyfh/5cc53fa67d229017231cf18c91768bd9","tags":["article"]},{"url":"https://gitlab.com/libtiff/libtiff/-/commit/9ce4d089bcf25496663776d9e6336738112f09a3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523134","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52492","tags":["advisory"]},{"url":"https://gist.github.com/okyfh/fbc5a37cade358361d80f6a498560cfa","tags":["article"]},{"url":"https://gitlab.com/libtiff/libtiff/-/commit/94affc5cf54111312f9891eb77accb93eebc28d7","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264252-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280164","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18495","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264845-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18495","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18495","title":"Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T17:41:36.4Z","modified":"2026-11-05T19:25:29.345Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-76166","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T17:41:36Z","modified":"2026-11-05T19:25:29Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-05T20:01:48.21368Z"}],"ghsa":[{"id":"GHSA-6x88-8xw5-p2gw","title":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf`...","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T18:31:26Z","modified":"2026-09-11T18:31:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:11:45.091927Z"}],"nvd":[{"id":"CVE-2026-18495","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T18:16:56.69Z","modified":"2026-11-05T20:17:52.62Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-05T21:56:44.017277Z"}],"osv":[{"id":"BELL-CVE-2026-18495","status":"published","published":"2026-09-13T06:04:27.79734Z","modified":"2026-10-06T07:15:03.673318851Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-18495","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T18:16:56.69Z","modified":"2026-10-08T09:47:25.442211275Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-4063","title":"libtiff security update","description":"This  provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.(CVE-2026-18495)","status":"published","published":"2026-09-25T01:27:57Z","modified":"2026-09-25T01:45:10.359795736Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:53467","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:14:37Z","modified":"2026-10-08T10:14:35Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-18495","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T18:16:00Z","modified":"2026-11-09T12:49:53.330549588Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"AZL-101736","title":"CVE-2026-18495 affecting package libtiff 4.6.0-14","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.","status":"published","published":"2026-09-11T18:16:56Z","modified":"2026-09-21T05:34:22Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"SUSE-SU-2026:4252-1","title":"Security update for tiff","description":"This update for tiff fixes the following issue:\n\n- CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough (bsc#1280164).\n","status":"published","published":"2026-09-17T16:01:31Z","modified":"2026-09-18T10:00:04.758773535Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4845-1","title":"Security update for tiff","description":"This update for tiff fixes the following issue:\n\n- CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough (bsc#1280164).\n","status":"published","published":"2026-10-21T15:55:24Z","modified":"2026-10-22T11:45:03.862304516Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}