libtiff CVE-2026-36849

The target application must accept and process attacker-supplied TIFF files through libtiff without prior validation of tag field values such as SamplesPerPixel. This condition is met by any file upload endpoint, image conversion service, or document processing pipeline that handles TIFF input. In automated server-side scenarios (no user interaction required), exploitation is straightforward: the attacker simply submits the crafted file. In client-side scenarios (desktop image viewers), a victim user must open the file. Authentication requirements are not determinable from available data, as no CVSS vector was provided; in practice, many image upload endpoints are accessible without authentication. Exploitation is limited to denial of service - no code execution or data access has been demonstrated. Systems that do not process TIFF files, or that pre-screen uploads with a separate validator, are not affected.

No CVSS score or vector was provided by the reporter or NVD, and no CWE is assigned, which limits precision in this assessment. The vulnerability is limited to a denial-of-service impact - no code execution, privilege escalation, or data exfiltration is claimed or implied. Real-world risk is context-dependent: server-side applications that automatically process user-supplied TIFF images (cloud storage, document conversion APIs, print pipelines) face a meaningful availability risk because exploitation requires only file delivery, not authentication. Conversely, desktop image viewers require a user to open the malicious file, substantially reducing automated attack surface. EPSS data is not available; however, DoS-only library vulnerabilities without a public exploit typically see low exploitation rates. Neither CISA KEV listing nor POC code has been identified, suggesting this is currently a theoretical rather than actively exploited risk. The upstream fix commit exists on a GitLab omnibus mirror rather than the canonical libtiff repository, introducing uncertainty about whether a formal release has occurred.

An attacker crafts a minimal TIFF file in which the SamplesPerPixel tag is set to an extremely large integer value and submits it to a web service or API endpoint that processes TIFF images using libtiff. When the service automatically decodes the file, libtiff consumes excessive memory or enters an abnormal processing loop, causing the worker process to crash or become unresponsive, resulting in a denial of service for legitimate users. No public POC has been identified, but the attack primitive - a malformed tag in a binary file format - is low-complexity to construct independently.