CVE-2026-52492

Awaiting Analysis Awaiting Analysis - Queue

Integer Overflow Leading to Heap Buffer Overflow in libtiff rgb2ycbcr

Publication date: 2026-08-24

Last updated on: 2026-09-09

Assigner: MITRE

Description

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-09-09

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-12

NVD

CVE-2026-52492

EUVD

EUVD-2026-65145

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the libtiff library's rgb2ycbcr utility function cvtRaster(). It occurs when calculating strip buffer sizes for YCbCr conversion of a TIFF image. The overflow leads to an undersized heap allocation, which can cause a heap-based buffer overflow during processing of a specially crafted TIFF file.

Detection Guidance

This vulnerability involves an integer overflow in libtiff's rgb2ycbcr utility during YCbCr conversion of TIFF images. To detect it, monitor for crashes or memory corruption when processing TIFF files with tools like libtiff's tiffinfo, tiffdump, or convert. Test with malformed TIFF files to observe abnormal behavior.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by tricking a user into processing a malicious TIFF image. It affects systems using libtiff for image processing, potentially leading to system compromise or crashes.

Compliance Impact

This vulnerability involves a heap-based buffer overflow in libtiff's rgb2ycbcr utility during YCbCr conversion of crafted TIFF images. Such flaws could lead to arbitrary code execution or denial of service, potentially compromising data integrity and confidentiality. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access or corruption of sensitive information.

Mitigation Strategies

Update libtiff to the latest patched version to address the integer overflow in rgb2ycbcrs cvtRaster() function.

Hi! I’m here to help you understand CVE-2026-52492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70