libtiff CVE-2026-18495

Exploitation requires that the target user explicitly invoke the tiff2pdf utility against an attacker-supplied BigTIFF file; the vulnerability is specific to the BigTIFF format variant (not standard TIFF), meaning the crafted file must carry BigTIFF magic bytes and a pathologically large StripByteCounts field. A low-privileged local account is sufficient. The CVSS UI:R metric confirms that a user must actively open or process the file - automated server-side pipelines that invoke tiff2pdf on untrusted uploads represent the realistic no-interaction-from-human-user scenario. The scope is limited to the local system (S:U); no lateral movement or privilege escalation beyond heap corruption is described. Standard TIFF files and other libtiff utilities are not affected by this specific truncation path.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H yields a moderate score of 6.1, accurately reflecting that exploitation requires local access, low-privilege credentials, and active user interaction - a user must run tiff2pdf against a malicious file. The availability impact is rated High (crash and memory corruption), while confidentiality and integrity impacts are Low, consistent with a heap overflow that may leak adjacent heap content or permit limited controlled writes. No EPSS score is provided in the input data. The vulnerability is not listed in the CISA KEV catalogue, and no public proof-of-concept exploit has been identified. Real-world prioritisation should be moderate: while memory corruption vulnerabilities carry inherent severity, the requirement for local access and explicit user interaction substantially reduces the attack surface compared to a network-exploitable flaw. Environments where untrusted BigTIFF files are batch-processed by automated pipelines running as low-privileged users represent the highest-risk deployment scenario. The CVSS vector is internally consistent with the description and no anomalies are detected.

An attacker crafts a malicious BigTIFF file containing an oversized StripByteCounts value that, when truncated to 32 bits, produces a dramatically smaller value than the actual strip data size. The attacker delivers the file to a target user - via email attachment, shared storage, or a content upload endpoint - and persuades them to convert it with tiff2pdf. When the utility allocates the undersized buffer and copies strip data into it, the heap overflow corrupts adjacent allocator metadata or application data, crashing the process and potentially enabling further memory-corruption primitives.