libtiff tiff2pdf Heap-BUF Overflow via Truncated StripByteCounts
CVE-2026-18495 Published on September 11, 2026

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-18495 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 27 days later.

Weakness Type

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().


Products Associated with CVE-2026-18495

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Hummingbird
 
Red Hat Ceph Storage
 
Red Hat Enterprise Linux (RHEL)
 

Affected Versions

Red Hat Hardened Images: Red Hat Ceph Storage 4: Red Hat Ceph Storage 6: Red Hat Ceph Storage 7: Red Hat Ceph Storage 8: Red Hat Ceph Storage 9: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Hardened Images: