VDB
RHSA-2026:49671
RHSA-2026:49671
PUBLISHED
CVSS 7.5 HIGH
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-devel-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-devel-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-0:4.6.0-6.el10_0.4.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-tools-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
| Red Hat | libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | 0:4.6.0-6.el10_0.4 |
…and 17 more
Timeline
- Aug 3, 2026 CVE Published
- Aug 5, 2026 CVE Updated
- Aug 5, 2026 Distribution Patch
- Aug 5, 2026 Distribution Patch
- Aug 5, 2026 Security Advisory
- Aug 5, 2026 Security Advisory
- Aug 5, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:49671 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2251326 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2492871 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49671.json advisory
- https://access.redhat.com/security/cve/CVE-2023-52355 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-52355 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-52355 advisory
- https://gitlab.com/libtiff/libtiff/-/issues/621 advisory
- https://access.redhat.com/security/cve/CVE-2026-12912 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-12912 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-12912 advisory
- https://gitlab.com/libtiff/libtiff/-/merge_requests/873 advisory
- https://gitlab.com/libtiff/libtiff/-/work_items/824 advisory