Skip to main content

libtiff CVE-2026-12912

| EUVDEUVD-2026-40151 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-29 secalert@redhat.com GHSA-cg4c-j43f-qcg7
RCE Buffer Overflow Denial Of Service Heap Overflow
7.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local file-parsing bug needing victim interaction (UI:R) plus a non-default 8BITABGR output format and specific stride (AC:H); no target privileges needed (PR:N), with full memory-corruption impact.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 17:31 vuln.today

DescriptionCVE.org

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).

AnalysisAI

Heap-based buffer overflow in libtiff's PixarLog codec decoder lets attackers crash or potentially execute code in any application that decodes a maliciously crafted PixarLog-compressed TIFF using the PIXARLOGDATAFMT_8BITABGR output format with a specific stride value. Any software linking libtiff for TIFF decoding is exposed, with impact ranging from denial of service to potential arbitrary code execution. No public exploit identified at time of analysis and the issue is not on the CISA KEV list, so exploitation is theoretical rather than observed.

Technical ContextAI

libtiff is the de facto reference C library for reading and writing TIFF images and is bundled into operating systems, image viewers, document/PDF processors, and countless desktop and server applications. The flaw lives in the PixarLog decompression path: when the codec emits pixels in the PIXARLOGDATAFMT_8BITABGR format and a particular stride (row-length) value is in effect, the output buffer is sized incorrectly relative to what the decoder writes, producing a heap write past the allocation. This maps to CWE-122 (Heap-based Buffer Overflow), a memory-safety root cause where attacker-influenced data corrupts adjacent heap metadata or objects - the classic precondition for both crashes and controlled-write code execution.

Affected ProductsAI

The affected component is the libtiff library (PixarLog codec) maintained at gitlab.com/libtiff/libtiff; specific affected and fixed version ranges are not enumerated in the provided data and no CPE strings were supplied, so the precise version boundaries are not independently confirmed. By extension, any operating system distribution or application that statically or dynamically links the vulnerable libtiff and decodes PixarLog TIFFs with the 8BITABGR output format is affected. Authoritative tracking is available via the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-12912) and Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2492871), with upstream detail in GitLab work item https://gitlab.com/libtiff/libtiff/-/work_items/824.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the upstream correction tracked in GitLab merge request https://gitlab.com/libtiff/libtiff/-/merge_requests/873 and rebuild/redeploy libtiff, or install the patched package from your OS vendor once published (track Red Hat at https://access.redhat.com/security/cve/CVE-2026-12912 and Bugzilla 2492871 for the exact errata version). Because no tagged release version is confirmed in the input data, do not pin to an invented version number - pull the fixed commit or wait for distribution errata. As a compensating control until patched, avoid decoding untrusted TIFFs through code paths that request the PIXARLOGDATAFMT_8BITABGR output format, or reject/transcode PixarLog-compressed TIFFs at ingestion (e.g. re-encode incoming images to a safe format before downstream processing); the trade-off is that legitimate PixarLog 8BITABGR workflows break. Where feasible, sandbox or isolate image-decoding processes so a heap overflow cannot escalate beyond the parser, at the cost of added IPC/performance overhead.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-12912 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy