Arbitrary Code Execution Vulnerability in LibTIFF by The LibTIFF Group
CVE-2026-52490

9.8CRITICAL

Key Information:

Vendor

The LibTIFF Group

Status
LibTIFF
Vendor
CVE Published:
24 August 2026

What is CVE-2026-52490?

An identified issue in LibTIFF can permit attackers to execute arbitrary code through the process_command_opts() function located in tools/tiffcrop.c. Proper validation is critical to safeguard against malicious inputs that could exploit this vulnerability, potentially leading to significant security risks for applications relying on this library.

References

https://gitlab.com/libtiff/libtiff/-/work_items/846
https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3b...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.