Skip to content
OpenAdvisories
High ALAS2-2026-3921 3 CVEs

Important: libtiff security update (Amazon Linux 2)

Published Sep 14, 2026 · Updated Sep 14, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-52492: An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image CVE-2026-52491: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component CVE-2026-52490: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libtiff 0:4.0.3-35.amzn2.0.32
Amazon Linux · 2 libtiff-debuginfo 0:4.0.3-35.amzn2.0.32
Amazon Linux · 2 libtiff-devel 0:4.0.3-35.amzn2.0.32
Amazon Linux · 2 libtiff-static 0:4.0.3-35.amzn2.0.32
Amazon Linux · 2 libtiff-tools 0:4.0.3-35.amzn2.0.32

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-52490

    An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the proce…

    tiff Debian
  • High 8.4
    CVE-2026-52491

    An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libti…

    tiff libtiff Debian Azure Linux
  • High 7.8
    CVE-2026-52492

    An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can resul…

    tiff libtiff Debian Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-52490.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-52491.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-52492.html