Skip to main content

Red Hat Enterprise Linux 10 CVE-2026-4775

| EUVDEUVD-2026-14901 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-03-24 redhat
RCE Denial Of Service Integer Overflow Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
7.8
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious TIFF file with integer overflow
  2. Exploit
    Open file triggering putcontig8bitYCbCr44tile function
  3. Execution
    Corrupt heap memory pointer calculations
  4. Impact
    Execute arbitrary code or crash application

Vulnerability Assessment

Weakness
CWE
CWE-190
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Victim must open a crafted TIFF image file with libtiff library (any version with vulnerable putcontig8bitYCbCr44tile function). Local attacker or remote attacker sending file via email/web. No authentication required. Affects applications linked against vulnerable libtiff.
Impact

The CVSS score of 7.8 (High) reflects significant technical impact with high confidentiality, integrity, and availability impacts. However, the attack vector is Local (AV:L) requiring user interaction (UI:R), meaning an attacker must convince a user to open a malicious TIFF file rather than exploiting the vulnerability remotely over a network. This substantially reduces the practical exploitation surface compared to network-exploitable vulnerabilities. The low attack complexity (AC:L) and lack of required privileges (PR:N) make exploitation straightforward once user interaction is achieved. Without EPSS data or KEV inclusion, there are no signals of active exploitation in the wild. The vulnerability is primarily a concern for systems that automatically process TIFF files from untrusted sources or for targeted attacks using social engineering. Real-world risk is moderate: high impact if exploited, but exploitation requires user participation and file delivery, making it less dangerous than remotely exploitable vulnerabilities with similar CVSS scores.
Exploit ScenarioDerived

An attacker crafts a malicious TIFF file with specially constructed YCbCr tile data designed to trigger the signed integer overflow in putcontig8bitYCbCr44tile. The attacker distributes this file via email attachment, web download, or file sharing, relying on social engineering to convince the victim to open it with an application using the vulnerable libtiff library. Upon opening, the integer overflow causes heap corruption that the attacker leverages to execute arbitrary code with the privileges of the application processing the image.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 24, 2026

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.

RemediationAI

Apply security updates for libtiff as provided by Red Hat for the affected Enterprise Linux versions by monitoring the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-4775 and following vendor patch guidance. Until patches can be deployed, implement defense-in-depth measures including restricting TIFF file processing to trusted sources only, running applications that handle TIFF files with reduced privileges or in sandboxed environments, and deploying file validation or sanitization at ingress points. Organizations should prioritize patching systems that automatically process TIFF files from untrusted sources or internet-facing applications that accept image uploads. Review the Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2450768 for specific patch availability timelines and version details.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability affects the libtiff library, a widely-used open-source library for reading and writing Tagged Image File Format (TIFF) files. The flaw resides in the putcontig8bitYCbCr44tile function, which handles YCbCr color space conversion for tiled TIFF images. This is a CWE-190 (Integer Overflow or Wraparound) vulnerability where signed integer arithmetic can overflow during tile processing, causing memory pointer calculations to produce incorrect addresses. When these miscalculated pointers are used for heap writes, they can write data beyond allocated buffer boundaries. Affected products confirmed via CPE data include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 distributions that bundle the vulnerable libtiff library.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 24, 2026 - 14:42 nvd
HIGH 7.8

DescriptionCVE.org

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

Executive ViewAI

Why It Matters

A critical vulnerability in libtiff affects Red Hat Enterprise Linux systems across multiple versions, allowing attackers to execute arbitrary code by distributing malicious TIFF files. This poses significant risk to any organization relying on RHEL infrastructure, particularly those processing user-supplied documents or images, and requires immediate mitigation pending vendor patch availability.

Business Impact: High
Compensating Controls

Disable TIFF file processing in applications where not business-critical; restrict file upload capabilities to trusted sources only; implement strict input validation and sandboxing for TIFF file handling; deploy network segmentation to isolate systems processing untrusted TIFF files; use application whitelisting to prevent exploitation; monitor system logs for suspicious TIFF-related activity; block TIFF file transfers at email gateways and web proxies pending patch availability.

Threat Intelligence Overview

EPSS Score
0.1%
Top 83% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-6732 HIGH
7.5 Apr 23

Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

Debian

tiff
Release Status Fixed Version Urgency
bullseye vulnerable 4.2.0-1+deb11u5 -
bullseye (security) vulnerable 4.2.0-1+deb11u7 -
bookworm, bookworm (security) vulnerable 4.5.0-6+deb12u3 -
trixie (security), trixie vulnerable 4.7.0-3+deb13u1 -
forky, sid vulnerable 4.7.1-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4775 ADVISORY https://vuldb.com/?id.352791 REF https://access.redhat.com/errata/RHSA-2026:12265 REF https://access.redhat.com/errata/RHSA-2026:12271 REF https://access.redhat.com/errata/RHSA-2026:14929 REF https://access.redhat.com/errata/RHSA-2026:16055 REF https://access.redhat.com/errata/RHSA-2026:19150 REF https://access.redhat.com/errata/RHSA-2026:19363 REF https://access.redhat.com/errata/RHSA-2026:19585 REF https://access.redhat.com/errata/RHSA-2026:19586 REF https://access.redhat.com/errata/RHSA-2026:19604 REF https://access.redhat.com/errata/RHSA-2026:19608 REF https://access.redhat.com/errata/RHSA-2026:19609 REF https://access.redhat.com/errata/RHSA-2026:19657 REF https://access.redhat.com/errata/RHSA-2026:19659 REF https://access.redhat.com/errata/RHSA-2026:19702 REF https://access.redhat.com/errata/RHSA-2026:20583 REF https://access.redhat.com/errata/RHSA-2026:20585 REF https://access.redhat.com/errata/RHSA-2026:20591 REF https://access.redhat.com/errata/RHSA-2026:20592 REF https://access.redhat.com/errata/RHSA-2026:24992 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:25910 REF https://access.redhat.com/errata/RHSA-2026:30078 REF https://access.redhat.com/errata/RHSA-2026:30087 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:30089 REF https://access.redhat.com/errata/RHSA-2026:30349 REF https://access.redhat.com/errata/RHSA-2026:33388 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/security/cve/CVE-2026-4775 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450768 REF https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy