Skip to main content

libtiff EUVDEUVD-2026-40151

| CVE-2026-12912 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-29 secalert@redhat.com GHSA-cg4c-j43f-qcg7
RCE Buffer Overflow Denial Of Service Heap Overflow
7.3
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious PixarLog TIFF
  2. Delivery
    Deliver via email/upload/share
  3. Exploit
    Victim app decodes with 8BITABGR + bad stride
  4. Execution
    Heap buffer overflow in PixarLog decoder
  5. Impact
    Crash or arbitrary code execution

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim's application to decode a PixarLog (codec) compressed TIFF using the PIXARLOGDATAFMT_8BITABGR output format together with a specific stride value - these are the exact preconditions named in the description; applications that do not request 8BITABGR output or do not process PixarLog images are not on the vulnerable path. The CVSS vector adds AV:L (the malicious file must be processed locally), UI:R (a user or service must open/load the crafted image), and PR:L per NVD (though for a typical file-open bug no special privileges are normally needed, so this requirement is not clearly justified by the description). Limiting factors: it is not a remote network-listener bug, it depends on a non-default output-format configuration, and it requires user/service interaction to ingest the file.
Impact

The signals are mixed and should temper the headline CVSS 7.3 (High). The NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R describes a local attack vector requiring user interaction, which contradicts the description's 'remote attacker' wording; the reconciliation is that the malicious TIFF arrives remotely but is processed locally when a victim opens it, so this behaves as a file-parsing (open-a-malicious-file) bug, not a network-listener RCE. No EPSS score was provided, the issue is not in CISA KEV, and no POC is referenced - only an upstream GitLab merge request - so there is no evidence of active or imminent exploitation. Exploitability is further gated by a non-default condition: the calling application must request the PIXARLOGDATAFMT_8BITABGR output format and hit the specific stride, so many libtiff consumers never reach the vulnerable path. Net: a credible memory-corruption bug in a ubiquitous library that warrants patching, but real-world risk today is moderate and conditional rather than a drop-everything emergency. Note also that the official vector lists PR:L, which is unusual for a file-open bug where no target privileges are normally needed - verify the privilege assumption with the vendor.
Exploit ScenarioDerived

An attacker crafts a PixarLog-compressed TIFF that triggers the heap overflow and delivers it via email, a web upload/preview pipeline, or a shared document; when a victim or automated service opens it with an application that decodes via the 8BITABGR output format and the vulnerable stride, the overflow corrupts the heap, causing a crash (DoS) or potentially attacker-controlled code execution. Given AV:L/UI:R, success depends on the victim actually processing the file rather than on a remote network probe, and no public POC is currently known.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Heap-based buffer overflow in libtiff's PixarLog codec decoder lets attackers crash or potentially execute code in any application that decodes a maliciously crafted PixarLog-compressed TIFF using the PIXARLOGDATAFMT_8BITABGR output format with a specific stride value. Any software linking libtiff for TIFF decoding is exposed, with impact ranging from denial of service to potential arbitrary code execution. No public exploit identified at time of analysis and the issue is not on the CISA KEV list, so exploitation is theoretical rather than observed.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the upstream correction tracked in GitLab merge request https://gitlab.com/libtiff/libtiff/-/merge_requests/873 and rebuild/redeploy libtiff, or install the patched package from your OS vendor once published (track Red Hat at https://access.redhat.com/security/cve/CVE-2026-12912 and Bugzilla 2492871 for the exact errata version). Because no tagged release version is confirmed in the input data, do not pin to an invented version number - pull the fixed commit or wait for distribution errata. As a compensating control until patched, avoid decoding untrusted TIFFs through code paths that request the PIXARLOGDATAFMT_8BITABGR output format, or reject/transcode PixarLog-compressed TIFFs at ingestion (e.g. re-encode incoming images to a safe format before downstream processing); the trade-off is that legitimate PixarLog 8BITABGR workflows break. Where feasible, sandbox or isolate image-decoding processes so a heap overflow cannot escalate beyond the parser, at the cost of added IPC/performance overhead.

Affected ProductsAI

The affected component is the libtiff library (PixarLog codec) maintained at gitlab.com/libtiff/libtiff; specific affected and fixed version ranges are not enumerated in the provided data and no CPE strings were supplied, so the precise version boundaries are not independently confirmed. By extension, any operating system distribution or application that statically or dynamically links the vulnerable libtiff and decodes PixarLog TIFFs with the 8BITABGR output format is affected. Authoritative tracking is available via the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-12912) and Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2492871), with upstream detail in GitLab work item https://gitlab.com/libtiff/libtiff/-/work_items/824.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libtiff is the de facto reference C library for reading and writing TIFF images and is bundled into operating systems, image viewers, document/PDF processors, and countless desktop and server applications. The flaw lives in the PixarLog decompression path: when the codec emits pixels in the PIXARLOGDATAFMT_8BITABGR format and a particular stride (row-length) value is in effect, the output buffer is sized incorrectly relative to what the decoder writes, producing a heap write past the allocation. This maps to CWE-122 (Heap-based Buffer Overflow), a memory-safety root cause where attacker-influenced data corrupts adjacent heap metadata or objects - the classic precondition for both crashes and controlled-write code execution.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local file-parsing bug needing victim interaction (UI:R) plus a non-default 8BITABGR output format and specific stride (AC:H); no target privileges needed (PR:N), with full memory-corruption impact.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.3 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).

Executive ViewAI

Why It Matters

A heap-based buffer overflow in libtiff affecting any application that decodes TIFF images creates risk of denial of service or code execution across organizations using affected software. Wide adoption of libtiff in document management, imaging, and design platforms means many enterprises are potentially exposed with no current vendor patch available. Immediate compensating controls are required to reduce exploitation risk.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict TIFF file processing to internal, trusted sources; implement strict file type validation at ingestion boundaries; disable PixarLog codec support in libtiff configuration options where available; configure real-time monitoring of application error logs and process crashes; implement network segmentation isolating systems that process untrusted TIFF files; apply principle of least privilege to processes invoking libtiff; maintain incident response procedures for active exploitation discovery.

Threat Intelligence Overview

EPSS Score
0.2%
Top 86% exploitable
Prevalence
Ubiquitous
core TIFF library bundled across OSes, viewers, and document tools
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-12912 ADVISORY https://vuldb.com/vuln/374659 REF https://access.redhat.com/errata/RHSA-2026:34890 REF https://access.redhat.com/errata/RHSA-2026:41892 REF https://access.redhat.com/errata/RHSA-2026:42668 REF https://access.redhat.com/errata/RHSA-2026:47183 REF https://access.redhat.com/errata/RHSA-2026:47184 REF https://access.redhat.com/errata/RHSA-2026:49671 REF https://access.redhat.com/errata/RHSA-2026:50774 REF https://access.redhat.com/errata/RHSA-2026:54638 REF https://access.redhat.com/errata/RHSA-2026:54640 REF https://access.redhat.com/errata/RHSA-2026:54642 REF https://access.redhat.com/errata/RHSA-2026:58545 REF https://access.redhat.com/errata/RHSA-2026:58553 REF https://access.redhat.com/errata/RHSA-2026:58554 REF https://access.redhat.com/errata/RHSA-2026:58556 REF https://access.redhat.com/errata/RHSA-2026:61657 REF https://access.redhat.com/errata/RHSA-2026:69292 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:83550 REF https://access.redhat.com/security/cve/CVE-2026-12912 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492871 REF https://gitlab.com/libtiff/libtiff/-/merge_requests/873 REF https://gitlab.com/libtiff/libtiff/-/work_items/824 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy