libtiff CVE-2026-52491

Exploitation requires that the libtiff thumbnail command-line tool (libtiff/tools/thumbnail.c) be invoked against an attacker-supplied or attacker-controlled TIFF file. The highest-risk scenario is an automated server-side image processing pipeline where the thumbnail tool processes untrusted user-uploaded TIFF files without human interaction - in this case, no end-user interaction is required. In purely interactive desktop contexts, a user must explicitly run the thumbnail tool on a crafted file, which requires social engineering or similar inducement. Exploitation is bounded by the following limiting factors: the thumbnail tool must be installed and accessible on the target system; the deployed libtiff commit must predate the fix (9ce4d089bcf25496663776d9e6336738112f09a3); and attacker-controlled TIFF data must reach the tool as input. Systems that do not use the thumbnail utility directly, process only TIFF files from trusted internal sources, or run libtiff versions incorporating the fix commit are not realistically at risk.

The CVSS base score of 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects high technical impact but is constrained to a local attack vector, limiting network-reachable exposure compared to a network-vector vulnerability. EPSS at 0.17% (6th percentile) is very low, strongly suggesting this vulnerability is not being actively weaponized or exploited at scale. The vulnerability is absent from CISA KEV, further corroborating low active exploitation. The PR:N/UI:N assignment with AV:L is consistent with automated server-side pipelines that invoke the thumbnail tool on untrusted input without human interaction; in purely interactive desktop use, some user action is necessary to invoke the tool on the crafted file, which the CVSS UI:N metric does not fully capture - this is a minor internal inconsistency worth verifying with the reporter. The referenced GitHub Gist may document a proof-of-concept, but POC status is not explicitly confirmed in available metadata. Overall, despite the high CVSS score, the combination of local attack vector, very low EPSS, and no KEV listing places this at low-to-moderate actual priority - organizations running automated TIFF processing pipelines using the libtiff thumbnail tool represent the primary risk population.

An attacker crafts a TIFF file with manipulated metadata values engineered to trigger an integer wraparound in thumbnail's main() when computing buffer sizes or array indices. The file is submitted to an automated server-side image processing service that invokes the libtiff thumbnail tool on untrusted user uploads; the overflow corrupts heap memory, overwriting a function pointer or return address and redirecting execution to attacker-controlled shellcode or a ROP chain. The GitHub Gist referenced in the CVE data (https://gist.github.com/okyfh/5cc53fa67d229017231cf18c91768bd9) may document the precise crafted TIFF fields required to reproduce this condition.