CVE-2026-18495
Received Received - Intake

Heap Buffer Overflow in libtiff via BigTIFF Processing

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: redhat-SADP

Description
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-18495
EUVD
EUVD-2026-76166

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libtiff libtiff *
libtiff libtiff From 3.9.0 (inc) to 4.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18495 is a heap-buffer overflow vulnerability in the libtiff library's tiff2pdf utility. It occurs when processing specially crafted BigTIFF files. A 64-bit StripByteCounts value is incorrectly truncated to a 32-bit integer, leading to an undersized memory allocation. This causes an out-of-bounds memory copy that can crash the program or corrupt memory.

Detection Guidance

To detect this vulnerability, check the version of libtiff installed on your system. Vulnerable versions are 3.9.0 through 4.7.0. Run: 'tiffinfo --version' or 'rpm -q libtiff' on Linux. Inspect files processed by tiff2pdf for crashes or memory corruption when handling BigTIFF files.

Impact Analysis

This vulnerability can cause crashes or severe memory corruption when a user opens a malicious BigTIFF file with tiff2pdf. It may lead to denial of service or potential arbitrary code execution. The impact requires local access and user interaction, such as opening a crafted file.

Mitigation Strategies

Upgrade libtiff to version 4.7.1 or later. If upgrading is not immediately possible, avoid processing untrusted BigTIFF files with tiff2pdf. Restrict user access to files and applications that use libtiff until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart