libtiff EUVD-2026-65144

Exploitation requires that the vulnerable tiffcrop tool actually be invoked on attacker-influenced input - either a crafted TIFF file or attacker-controlled command-line options reaching process_command_opts() in tools/tiffcrop.c. This limits realistic exploitation to environments that run tiffcrop against untrusted data (e.g., automated image-conversion services or scripts), and implies local/tool-invocation access rather than the remote no-interaction exploitation the published AV:N/UI:N vector suggests - that mismatch should be resolved with the maintainer. There is no indication of authentication being required, but a user or service must execute tiffcrop for the bug to trigger.

The signals conflict sharply and should temper the headline 9.8. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, no-interaction network exploitation, but the actual sink - process_command_opts() in the tiffcrop CLI - parses command-line options for a locally invoked tool, which is inherently local and requires a user to run tiffcrop against attacker-controlled input; the network vector is almost certainly overstated and should be verified against the vendor/GitLab work item. Against that, EPSS is very low (0.16%, 5th percentile) and the CVE is not in CISA KEV, so there is no indication of mass exploitation, though a referenced gist suggests proof-of-concept code may be circulating. Net assessment: a genuine memory-safety/code-execution bug worth patching in any environment that runs tiffcrop in automated image pipelines, but its real-world priority is moderate rather than the emergency implied by the raw CVSS - treat it as a standard patch-cycle item unless tiffcrop is exposed to untrusted files in an automated workflow.

An attacker supplies a maliciously crafted TIFF file (or manipulates the arguments/options passed to tiffcrop in an automated conversion service) such that process_command_opts() mishandles the input and diverts execution to attacker-controlled code. In a batch image-processing pipeline that invokes tiffcrop on user-uploaded files, this yields code execution in the pipeline's context. Proof-of-concept material appears to be referenced via a public gist, lowering the barrier to reproduction.