CVE-2026-52492

Received Received - Intake

Integer Overflow Leading to Heap Buffer Overflow in libtiff rgb2ycbcr

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: MITRE

Description

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-52492

EUVD

EUVD-2026-65145

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the libtiff library's rgb2ycbcr utility function cvtRaster(). It occurs when calculating strip buffer sizes for YCbCr conversion of a TIFF image. The overflow leads to an undersized heap allocation, which can cause a heap-based buffer overflow during processing of a specially crafted TIFF file.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by tricking a user into processing a malicious TIFF image. It affects systems using libtiff for image processing, potentially leading to system compromise or crashes.

Mitigation Strategies

Update libtiff to the latest patched version to address the integer overflow in rgb2ycbcrs cvtRaster() function.

Hi! I’m here to help you understand CVE-2026-52492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70