Description
A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 4.7.1-2 | — |
| Debian 13 | tiff | 4.7.0-3+deb13u2 | — |
| Debian 12 | tiff | 4.5.0-6+deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qtwebengine-opensource-src | No fix yet | — |
| Ubuntu 26.04 LTS | tiff | No fix yet | — |
| Ubuntu 25.10 | tiff +2 | No fix yet | — |
| Ubuntu 24.04 LTS | tiff | No fix yet | — |
| Ubuntu 22.04 LTS | tiff | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | neuron | No fix yet | — |
| Ubuntu 18.04 LTS | neuron | No fix yet | — |
| Ubuntu Pro 26.04 LTS | qtwebengine-opensource-src | No fix yet | — |
| Ubuntu Pro 24.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | tiff +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | tiff +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gdal +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gdal +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libtiff +2 | 4.6.0-6.el10_1.3 | RHSA-2026:19150, RHSA-2026:12265 |
| RHEL 9 | libtiff +2 | 4.4.0-15.el9_7.3 | RHSA-2026:19363, RHSA-2026:12271 |
| RHEL 8 | compat-libtiff3 | 3.9.4-15.el8_10 | RHSA-2026:20585 |
| RHEL 8 | libtiff +2 | 4.0.9-37.el8_10 | RHSA-2026:16055 |
| RHEL 8 | mingw-libtiff +4 | 4.0.9-4.el8_10 | RHSA-2026:14929 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libtiff +2 | 4.6.0-6.el10_0.3 | RHSA-2026:19586 |
| RHEL 9.6 EUS | libtiff +2 | 4.4.0-13.el9_6.4 | RHSA-2026:19585 |
| RHEL 9.4 EUS | libtiff +2 | 4.4.0-12.el9_4.5 | RHSA-2026:19702 |
| RHEL 9.2 E4S | libtiff +1 | 4.4.0-8.el9_2.5 | RHSA-2026:19609 |
| RHEL 9.0 E4S | libtiff +1 | 4.2.0-3.el9_0.3 | RHSA-2026:19608 |
| RHEL 8.8 TUS | compat-libtiff3 | 3.9.4-13.el8_8.2 | RHSA-2026:20592 |
| RHEL 8.8 TUS | libtiff +1 | 4.0.9-29.el8_8.2 | RHSA-2026:19604 |
| RHEL 8.8 E4S | compat-libtiff3 | 3.9.4-13.el8_8.2 | RHSA-2026:20592 |
| RHEL 8.8 E4S | libtiff +1 | 4.0.9-29.el8_8.2 | RHSA-2026:19604 |
| RHEL 8.6 TUS | compat-libtiff3 | 3.9.4-13.el8_6.2 | RHSA-2026:20591 |
| RHEL 8.6 TUS | libtiff +1 | 4.0.9-21.el8_6.2 | RHSA-2026:19657 |
| RHEL 8.6 E4S | compat-libtiff3 | 3.9.4-13.el8_6.2 | RHSA-2026:20591 |
| RHEL 8.6 E4S | libtiff +1 | 4.0.9-21.el8_6.2 | RHSA-2026:19657 |
| RHEL 8.6 AUS | compat-libtiff3 | 3.9.4-13.el8_6.2 | RHSA-2026:20591 |
| RHEL 8.6 AUS | libtiff +1 | 4.0.9-21.el8_6.2 | RHSA-2026:19657 |
| RHEL 8.4 EUS Long Life | compat-libtiff3 | 3.9.4-13.el8_4.2 | RHSA-2026:20583 |
| RHEL 8.4 EUS Long Life | libtiff +1 | 4.0.9-18.el8_4.2 | RHSA-2026:19659 |
| RHEL 8.4 AUS | compat-libtiff3 | 3.9.4-13.el8_4.2 | RHSA-2026:20583 |
| RHEL 8.4 AUS | libtiff +1 | 4.0.9-18.el8_4.2 | RHSA-2026:19659 |
| RHEL 7 ELS | compat-libtiff3 | 3.9.4-12.el7_9.2 | RHSA-2026:24992 |
| RHEL 7 ELS | libtiff +3 | 4.0.3-35.el7_9.2 | RHSA-2026:25910 |
| Red Hat Hardened Images 1 | libtiff +3 | 4.7.1-2.2.hum1 | RHSA-2026:33388, RHSA-2026:30349 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libtiff +2 | 4.6.0-6.el10_1.3 | ALSA-2026:19150, ALSA-2026:12265 |
| AlmaLinux 9 | libtiff +2 | 4.4.0-15.el9_7.3 | ALSA-2026:19363, ALSA-2026:12271 |
| AlmaLinux 8 | compat-libtiff3 | 3.9.4-15.el8_10 | ALSA-2026:20585 |
| AlmaLinux 8 | libtiff +2 | 4.0.9-37.el8_10 | ALSA-2026:16055 |
| AlmaLinux 8 | mingw32-libtiff +3 | 4.0.9-4.el8_10 | ALSA-2026:14929 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libtiff | 4.6.0-6.el10_1.3 | RLSA-2026:19150, RLSA-2026:12265 |
| Rocky Linux 9 | libtiff | 4.4.0-15.el9_7.3 | RLSA-2026:19363, RLSA-2026:12271 |
| Rocky Linux 8 | compat-libtiff3 | 3.9.4-15.el8_10 | RLSA-2026:20585 |
| Rocky Linux 8 | libtiff | 4.0.9-37.el8_10 | RLSA-2026:16055 |
| Rocky Linux 8 | mingw-libtiff | 4.0.9-4.el8_10 | RLSA-2026:14929 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tiff | 4.7.2-150600.3.29.1 | SUSE-SU-2026:2853-1 |
| SLES 15 SP6 | tiff | 4.7.2-150600.3.29.1 | SUSE-SU-2026:2853-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | tiff | 4.7.1-160000.2.1 | SUSE-SU-2026:22616-1, SUSE-SU-2026:22306-1 |
| SLES for SAP 15 SP6 | tiff | 4.7.2-150600.3.29.1 | SUSE-SU-2026:2853-1 |
| SLES 16.0 | tiff | 4.7.1-160000.2.1 | SUSE-SU-2026:22616-1, SUSE-SU-2026:22306-1 |
| SLE Micro 6.2 | tiff | 4.7.1-160000.2.1 | SUSE-SU-2026:22590-1, SUSE-SU-2026:22234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Pillow | 12.3.0-1.1 | openSUSE-SU-2026:11261-1 |
| openSUSE Tumbleweed | tiff | 4.7.1-5.1 | openSUSE-SU-2026:10650-1 |
| openSUSE Leap 16.0 | tiff +1 | 4.7.1-160000.2.1 | openSUSE-SU-2026:21289-1, openSUSE-SU-2026:20995-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | qt6-qtwebengine | 6.11.0-r9 | — |
| Alpine v3.24 | tiff | 4.7.2-r0 | — |
| Alpine v3.23 | qt6-qtwebengine | 6.10.3-r3 | — |
| Alpine v3.23 | tiff | 4.7.2-r0 | — |
| Alpine v3.22 | tiff | 4.7.2-r0 | — |
| Alpine v3.21 | tiff | 4.7.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libtiff +3 | 4.4.0-4.amzn2023.0.26 | ALAS2023-2026-1547 |
| Amazon Linux 2 | compat-libtiff3 | 3.9.4-12.amzn2.0.9 | ALAS2-2026-3234 |
| Amazon Linux 2 | libtiff +3 | 4.0.3-35.amzn2.0.30 | ALAS2-2026-3235 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libtiff | 4.6.0-13 | — |
| Azure Linux 3 | openjpeg2 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libtiff +2 | 4.6.0-6.el10_1.3 | ELSA-2026-19150, ELSA-2026-12265 |
| Oracle Linux 9 | libtiff +2 | 4.4.0-15.el9_7.3 | ELSA-2026-19363, ELSA-2026-12271 |
| Oracle Linux 8 | compat-libtiff3 | 3.9.4-15.el8_10 | ELSA-2026-20585 |
| Oracle Linux 8 | libtiff +2 | 4.0.9-37.el8_10 | ELSA-2026-16055 |
| Oracle Linux 8 | mingw32-libtiff +3 | 4.0.9-4.el8_10 | ELSA-2026-14929 |
| Oracle Linux 7 | compat-libtiff3 | 3.9.4-12.0.3.el7 | ELSA-2026-24992 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | tiff | 4.7.1-r5 | — |
Advisories 50
- ALSA-2026:12265 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19363 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:12271 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19150 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:14929 Important: mingw-libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:16055 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:20585 Important: compat-libtiff3 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1031 libTIFF: Schwachstelle ermöglicht Codeausführung und DoS BSI CERT-Bund (WID) · Oct 14, 2026
- RHSA-2026:33388 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:30349 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:25910 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:24992 Red Hat Security Advisory: compat-libtiff3 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:20592 Red Hat Security Advisory: compat-libtiff3 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:20591 Red Hat Security Advisory: compat-libtiff3 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:20585 Red Hat Security Advisory: compat-libtiff3 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:20583 Red Hat Security Advisory: compat-libtiff3 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19702 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19659 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19657 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19609 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19604 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19608 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19586 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19585 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19363 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19150 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:16055 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:14929 Red Hat Security Advisory: mingw-libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:12271 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:12265 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- ELSA-2026-24992 Important: compat-libtiff3 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 30, 2026
- SUSE-SU-2026:22616-1 Security update for tiff SUSE / openSUSE Security Updates · Jul 17, 2026
- SUSE-SU-2026:22590-1 Security update for tiff SUSE / openSUSE Security Updates · Jul 16, 2026
- ELSA-2026-19150 Important: libtiff security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- openSUSE-SU-2026:21289-1 Security update for tiff SUSE / openSUSE Security Updates · Jul 13, 2026
- SUSE-SU-2026:2853-1 Security update for tiff SUSE / openSUSE Security Updates · Jul 13, 2026
- openSUSE-SU-2026:11261-1 python313-Pillow-12.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Jul 13, 2026
- SUSE-SU-2026:22306-1 Security update for tiff SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:20995-1 Security update for tiff SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22234-1 Security update for tiff SUSE / openSUSE Security Updates · Jun 24, 2026
- ELSA-2026-19363 Important: libtiff security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- RLSA-2026:19150 Important: libtiff security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:20585 Important: compat-libtiff3 security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19363 Important: libtiff security update Rocky Linux Security Advisories · May 28, 2026
- ELSA-2026-20585 Important: compat-libtiff3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 26, 2026
- RLSA-2026:16055 Important: libtiff security update Rocky Linux Security Advisories · May 13, 2026
- RLSA-2026:14929 Important: mingw-libtiff security update Rocky Linux Security Advisories · May 11, 2026
- ELSA-2026-16055 Important: libtiff security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 11, 2026
- ELSA-2026-14929 Important: mingw-libtiff security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 8, 2026
- RLSA-2026:12271 Important: libtiff security update Rocky Linux Security Advisories · May 1, 2026
References
- RHSA-2026:12265 vendor-advisory
- RHSA-2026:12271 vendor-advisory
- RHSA-2026:14929 vendor-advisory
- RHSA-2026:16055 vendor-advisory
- RHSA-2026:19150 vendor-advisory
- RHSA-2026:19363 vendor-advisory
- RHSA-2026:19585 vendor-advisory
- RHSA-2026:19586 vendor-advisory
- RHSA-2026:19604 vendor-advisory
- RHSA-2026:19608 vendor-advisory
- RHSA-2026:19609 vendor-advisory
- RHSA-2026:19657 vendor-advisory
- RHSA-2026:19659 vendor-advisory
- RHSA-2026:19702 vendor-advisory
- RHSA-2026:20583 vendor-advisory
- RHSA-2026:20585 vendor-advisory
- RHSA-2026:20591 vendor-advisory
- RHSA-2026:20592 vendor-advisory
- RHSA-2026:24992 vendor-advisory
- RHSA-2026:25096 vendor-advisory
- RHSA-2026:25910 vendor-advisory
- RHSA-2026:30078 vendor-advisory
- RHSA-2026:30087 vendor-advisory
- RHSA-2026:30088 vendor-advisory
- RHSA-2026:30089 vendor-advisory
- RHSA-2026:30349 vendor-advisory
- RHSA-2026:33388 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4775 vdb-entry
- RHBZ#2450768 issue-tracking