Red Hat Ceph Storage 8
Monthly
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.