Heap-Buffer Overflow Flaw in libtiff's tiff2pdf Utility
CVE-2026-18495

6.1MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Red Hat Ceph Storage 4
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Vendor
CVE Published:
11 September 2026

What is CVE-2026-18495?

A vulnerability exists in the tiff2pdf utility of libtiff, wherein a heap-buffer overflow occurs due to an integer truncation error while processing specially crafted BigTIFF files. An attacker can exploit this flaw by supplying a malicious BigTIFF file that causes a 64-bit StripByteCounts value to be incorrectly truncated to a 32-bit integer. This truncation results in an undersized memory allocation leading to out-of-bounds memory copying, ultimately causing application crashes or significant memory corruption. Proper validation measures should be implemented to mitigate such risks.

Affected Version(s)

Red Hat Hardened Images 4.7.2-2.hum1

References

https://access.redhat.com/errata/RHSA-2026:53467
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18495
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531414
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Jinbao Chen for reporting this issue.
.