Skip to main content

libtiff CVE-2026-52492

| EUVDEUVD-2026-65145 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-08-24 mitre GHSA-c22p-2vpj-rh5j
Integer Overflow Buffer Overflow N A Red Hat Suse
7.8
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local utility requiring no privileges to run, but user must actively invoke it on a crafted file; full code execution impact across all three pillars.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.6 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 27, 2026 - 22:36 vuln.today
CVSS changed
Aug 27, 2026 - 20:37 NVD
7.8 (HIGH)
CVE Published
Aug 24, 2026 - 00:00 cve.org
HIGH 7.8
CVE Published
Aug 24, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

AnalysisAI

Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target user (or an automated process acting on their behalf) invokes the rgb2ycbcr utility or a libtiff-linked application against an attacker-controlled TIFF file. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: exploitation is local and requires user interaction (the victim must run the utility against an attacker-supplied file), which substantially limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is to apply the upstream patch: commit 94affc5cf54111312f9891eb77accb93eebc28d7 to the libtiff GitLab repository (https://gitlab.com/libtiff/libtiff/-/commit/94affc5cf54111312f9891eb77accb93eebc28d7). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Immediately (within 24 hours) identify all systems, applications, and workflows using libtiff or tools that depend on it-particularly batch image processing, document management systems, or automated TIFF conversion pipelines. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in N A

View all
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
CVE-2026-45185 CRITICAL POC
9.8 May 12

Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
CVE-2025-50455 CRITICAL POC
9.1 Jul 27

SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
CVE-2026-36356 CRITICAL POC
9.1 May 05

Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
CVE-2026-31071 CRITICAL POC
9.1 May 19

Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
CVE-2025-66391 HIGH POC
8.8 Jun 17

Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
CVE-2026-75419 HIGH POC
8.8 Aug 27

go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
CVE-2026-26740 HIGH POC
8.2 Mar 18

Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when

CVE-2025-60464 HIGH POC
7.8 Jun 25

Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-52492 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy