libtiff CVE-2026-52492

Exploitation requires that the target user (or an automated process acting on their behalf) invokes the rgb2ycbcr utility or a libtiff-linked application against an attacker-controlled TIFF file. The CVSS UI:R metric reflects this dependency - the victim must actively open or process the malicious image. No authentication or elevated privileges are required to run the utility itself (PR:N), but the attacker must deliver the crafted file to a location where the victim will process it (e.g., email attachment, shared storage, web upload endpoint feeding a conversion pipeline). The vulnerability is specific to the YCbCr color conversion path in cvtRaster(); TIFF files not invoking that code path are not affected. No network-reachable service interface is implied by the AV:L vector - remote network delivery of the file is possible, but the vulnerability itself triggers only at local processing time. Limiting factors: requires user interaction, local execution context, and a TIFF file specifically routed through the YCbCr conversion path.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: exploitation is local and requires user interaction (the victim must run the utility against an attacker-supplied file), which substantially limits opportunistic mass exploitation. The EPSS score of 0.16% at the 5th percentile corroborates this - statistically, this vulnerability is not being exploited at scale in the near term, and it is not listed in the CISA KEV catalog. Despite that low probability signal, the technical severity is real: a successful heap overflow with full C:H/I:H/A:H impact could yield arbitrary code execution. The risk is most acute in automated image processing pipelines - batch converters, document workflows, or CI/CD systems that ingest untrusted TIFF files - where user-interaction is effectively bypassed at the system level. Organizations with scripted ingestion of external imagery should treat this with higher urgency than the EPSS alone suggests. The availability of a GitHub gist that may constitute a working proof-of-concept is a mild escalating signal, though it does not rise to confirmed active exploitation. No conflicting signals between data sources were identified; the CVSS vector and description are internally consistent.

An attacker crafts a TIFF image with dimensions or strip count values engineered to cause integer overflow in cvtRaster()'s buffer size arithmetic, producing an undersized heap allocation. The attacker delivers this file to a target who processes it with the rgb2ycbcr utility - either directly on the command line or via an application that calls libtiff internally. The heap overflow during YCbCr conversion overwrites adjacent heap metadata or function pointers, potentially yielding arbitrary code execution in the context of the process running the conversion. A GitHub gist (https://gist.github.com/okyfh/fbc5a37cade358361d80f6a498560cfa) may provide proof-of-concept material demonstrating the overflow trigger.